Data protection and IT security are key pillars of our software solution. In the following, you will find detailed information on the safeguards we have implemented to ensure the highest standards of security and compliance. For further questions or individual feedback, please feel free to reach out to the contact provided at the end of this page.
Application specific Security Features
Encoded Application Connection
In general, all client connections to the application and application programming interface (API) are encrypted with a valid SSL/-TSL certificate of strength SHA256RSA. There are no unencrypted connections, neither to the application itself nor to the application programming interface (API). During login, passwords are exclusively being transmitted encrypted.
Personal Application Access
Access to the entire application, with exception of the login mask provided on the homepage, is only possible via a personal access consisting of a username and password or registration key. Any access to the platform is exclusively provided by employees of ICUnet.AG and cannot be used without prior configuration. Accesses that are no longer used or whose validity date has expired are automatically deactivated by the application in a daily verification process. The users of the application are generally not permitted to share the user name and password of the personal access with other users and thus use accesses jointly.
Authentication mechanisms, passwords, password complexity and captcha queries
The user-specific password must consist of at least 10 characters and contain at least one uppercase character, one lowercase character, one number and one special character. In addition, each user is required to replace the initial password with a personal password after receiving the initial password - further access to the application is not possible without changing the initial password.
If the user has forgotten his or her password and uses the "forgot password" functionality of the application, it must be confirmed beforehand using a captcha query - the component used is reCAPTCHA from Google Inc.
Based on the respective user role, it may be possible to use one of the following authentication mechanisms:
Authentication via username and password to the application database
Authentication via username and password to a directory service (e.g. Microsoft Active Directory)
Authentication via Single-Sign-On to an IdentityProvider (e.g. SAML)
In addition, each user is free to activate multi-factor authentication with the following characteristics for his or her personal user profile:
Confirmation of user identity via e-mail security code
Confirmation of user identity via any TOTP app (e.g. Google Authenticator)
If multi-factor authentication is activated, application access is only possible after successful entry of the username and password if the user identity has been confirmed using one of the available variants.
User Roles and Rights
Before access is admitted, each user is allocated to one or more user roles which are predefined in the application and connected to respective user rights. Access to the different areas within the application is largely controlled by the assigned user roles and rights.
The currently predefined roles in the application:
External/Client: Assignee; HR Manager
External and Internal: Intercultural Expert; Relocation Partner
Internal/ICUnet.Group: Accounter; Administrator; Assignment Manager; Relocation Consultant
The application automatically allocates user roles and rights for external users. For internal use, user roles and rights are allocated by the IT department or by entitled groups within the ICUnet.AG Any alterations of the user rights must be implemented by the system administrators.
Processed Data Categories following GDPR
Following §9 GDPR, personal data that is sensible and worthy of protection is to be subdivided into special categories. These Datatypes can only be processed by a Service Provider if theres explicit consent by the data subject (see §9.1 GDPR).
Within IND we only collect and Process data required for our service provision. Depending on the requested service the collected data may include data from the following by GDPR defined special categories:
Data revealing racial or ethnic origin
Data revealing religious or philosophical beliefs
Data-access according to the "Need-to-Know"-Principle
Apart from the respective user rights, access to data is provided following the „Need-to-Know“ principle – this means that every user only has access to the data he needs to perform the designated tasks.
User Role and Access Rights
Accounter: Read only access to data and information of orders from customers, to whom the user, as accounter, is allocated to.
Administrator: Read/ write access to administrative and system-relevant data and information, not however to customer-specific data.
Assignee: Read/write access to data and information the user himself has entered into the application. Read only access to data and information specified in the order.
Assignment Manager: Read only access to data and information of orders from the customers, to whom the assignment manager is allocated to. Read and write access to data and information of customer orders to which the assignment manager has been allocated to and is active for.
Intercultural Expert: Read only access to data and information from other users in the role as intercultural experts, not however on customer-specific data and information
HR Manager: Read and write access to data and information entered into the application by the user himself. Partly read access to data and information of assignees in the context of specific customer orders and to whom the user is assigned to as HR manager
Relocation Partner/Consultant: Read only access to data and information in connection to orders to which the user is allocated to provide services to and be active for.
Encrypted Data Storage
All user data associated with the application are stored in a high security data center of a German provider located in Nuremberg, Germany. The data center meets the highest demands for security and redundancy and has been awarded the following certifications: TÜV – Geprüftes Rechenzentrum, TÜV – Geprüfte Energieeffizienz, TÜV – Service tested, TÜV – Management System Certified, TÜV IT – Trusted Site, ExpertOn Cloud Leader 2013, ExpertOn Cloud Leader Germany 2014, ExpertOn Security Leader Germany 2016, ExpertOn Cloud Leader Germany 2015.
Apart from all the existing backup and protection mechanisms, all the answers to questionnaires from external users regarding the order type Relocation-Services are stored in the application database with 256-bit Advanced Encryption Standard (AES).
The key required for decryption is stored exclusively in file form, logically separated from the application database, in a storage location on the application server (AS). A decoding of the values saved in the application database in encrypted form is practically impossible without the key located on the logically separated application server (AS).
Automatic Deletion of Data
Rules for deletion and archivation of data are adjustable for each individual customer-company:
After archivation, the data is only accessable by users with specific rights.
After deletion, it is no longer possible for any user or application administrator to recover personal data, because all information has been completely removed from the application database and all tables contained therein.
Log files and storage of security-relevant events
Safety-relevant changes, activities, errors and/or other results are automatically saved and stored as a log at database level. Access to the corresponding logs is reserved exclusively for privileged application administrators in the event of a necessary system analysis, e.g. in the case of reported malfunctions. A subsequent modification and/or mutation of the log files is technically not possible for application users.
Log files are regularly manually checked for irregularities with special attention to anomalies concerning Security. (e.g. an exceptionally high amount of accesses in dedicated timeslots).
All Log files are preserved for a maximum of 5 years, with them being deleted permanently from the database and the server after this period.
Code Security
Code Scans
To reassure the security of our code and to discover potential new security gaps, we regularly perform codesecurity scans via Snyk. This state of the art tool identifies security weaknesses of the implemented code as well as used external components and libraries. Identified problems are asigned an importance level and go on to be fixed in a timely manner.
Contact
Anna Schmitt, Head of Digitalization & Operations, is your personal contact and looks forward to receiving your enquiry by email: anna.schmitt@icunet.group