Learn more about our Security settings
Last updated: April 2019
Technical and Organisational Security Measures
All data is stored in highly secure environments that are protected from unauthorized access and accidental destruction or damage. Data security is safeguarded by a set of policies and access controls which are summarized in this Security Policy.
The Solution and the websites created via the Solution are hosted under managed services arrangements with industry leading vendors and with back-up and redundancy arrangements designed to avoid data loss or service interruption notwithstanding a disaster disabling the primary hosting facility.
The Mono Server setup is built to scale with multiple locations around the Globe. This ensures maximum site- & editor performance from any location in the world.
The 2 main elements of the set up are:
- Central Server Center & fail-over
- Local Server Centers (CDN)
The Server Centers
The Solution is hosted at maximum security facilities in Denmark, Canada and Germany. The Site Editor, the websites and the site API is served from Denmark, Canada and Germany. Sites and site data are backed up on each location as well as a separate off-site backup based in Copenhagen. Secure failover processes for all data is in place.
Premium Data Center Facilities
Maintained round the clock by highly trained staff, the data centers are designed and equipped to the highest industry standards - raised floors, automatic fire extinguishing equipment, AC and DC power distribution, uninterruptible power supplies (UPS), backup generators and multiple redundant fiber connections to all major carriers.
The data centers we use have all received the internationally recognized ISO 27001 certification and Certification for information security management systems.
Each data center has full power backup in case of an outage. Generators, in combination with UPS systems, guarantee maximum availability.
All Hosting facilities are equipped with redundant cooling equipment. Down-flow cooling units guarantee maximum cooling for your equipment. Room temperature is maintained at 18 to 25 C with a humidity level of 40% - 60%.
Every data centre is equipped with a state-of-the-art security system to prevent unauthorized access to equipment. With proximity cards, typically combined with biometric readers and mantraps, access is limited to authorised personnel.
Building management systems
All data centre related equipment, such as cooling equipment, electrical systems and fire control systems, is monitored around the clock. All events are controlled and procedures are in place to react to every possible incident 24 hours a day, 7 days a week, year round.
All data centers are equipped with fire detection and gas-based fire suppression systems as a first line defence against fire. Argon, FM-200 or CEA is used across our all facilities. (The type of gas used depends on the local fire regulations.) These systems are automatic and monitored continuously (24 x 7). All buildings are equipped with hand-held CO2 fire extinguishing systems, as required by local fire regulations.
Content Delivery Network
All Mono sites are hosted on a secure and multi-redundant Content Delivery Network (CDN). This includes generated (cached) content of the individual websites.
The CDN has multiple nodes and fall-back nodes located across North America, Europe, Asia and Australia. The CDN ensures optimized load speed for both the editor and sites no matter where they are located. This CDN also lowers latency and ensures maximum uptime of customer sites as each node acts as a local fail-over server.
List of current Locations in CDN (more locations are being added on on-going basis):
- Chicago (fail over node)
- Dallas (fail over node)
- Copenhagen (fail over)
Security & IP Technology
Mono operates with our own IP range which provides our CDN set up with further protection from DDoS attacks as well as fast and secure failover procedures.
Reseller specific IPs is also an option anywhere.
The platform runs on an optimized PHP code base, which is updated and sanitized on an ongoing basis.
The high stability and availability of the platform is unprecedented among industry standards.
1. ENTRANCE CONTROL
Technical or organisational measures regarding access control, especially regarding legitimation of authorised persons.
Security of the Physical Environment
The physical environment and facilities are designed to prevent unauthorized access to or damage to the Company´s Data:
- All system servers with information that require protection are kept in high security areas at external hosting facility where access is highly restricted.
- IT equipment in the Mono office area is safeguarded by a locked door policy and appropriate security system (intruder alarm and fire alarm).
- The Mono office area is safeguarded by an electronic access control system.
- All external doors and windows must be closed and locked at the end of the work day.
- All employees are trained in operating the office security systems.
Security of Equipment, devices and media
All Solution assets are carefully protected to ensure maximum security:
- All assets are recorded in a central asset inventory which is kept updated monthly.
- All hardware assets are owned by Mono – Mono does not borrow, rent or lease equipment.
- Employees in possession of equipment are educated in the acceptable use hereof. This includes instructions on safe-travelling with laptops, removable hard disks and mobile phones. In general, equipment must always be carried as hand-baggage and never left out of sight during travelling. The same policy applies to laptops being transported home for remote working purposes.
- Employees are instructed in safe use of all removable media devices such as external hard disks, USB keys which could carry malware etc.
- Deprecated equipment is being safely deposited for destruction, so that access to any information stored on this equipment is prevented.
2. System Access Control
Technical and organisational measures regarding the user ID and authentication aimed to prevent unauthorised use of data processing systems, used for the processing of Company Data:
Access Control and User Access Management
Access to any system carrying information is strictly safeguarded and subject to these security procedures:
- Access control to each system is documented and maintained by the administrator of that system.
- Each system has differentiated access rights/roles (where relevant) that only allow users to access the information which is required and appropriate for their role.
- Registration and de-registration of user access rights is maintained by the administrator of that system.
System and application access control
All mono employees have responsibility to adhere to Mono’s policies and practices for secure authentication and access:
- Only the administrator can override application access controls.
- Source code access control is limited to individuals and controlled by the system admin and access is logged on the server.
Protection from Malware
All mono employees have responsibility to install anti-virus / malware protection client.
- Users are instructed in how to install software.
- Users are instructed on how to act on security warnings.
- Users are instructed to update their software frequently.
3. DATA ACCESS CONTROL
Technical and organisational measures regarding the on-demand structure of the authorisation concept, data access rights and monitoring and recording of the same:
Logging and monitoring
Mono logs everything to be able to trace breaches and unauthorized access of any kind.
All serves have logs (access, system (OS) & application logs).
Mono has a Central Log repository in place, where it is possible to search through and monitor all logs 30 days back.
Logs are locked and protected from tampering.
All servers are synchronized (clock / UTC).
Administrator and operator access to servers is logged and access control are limited to the appointed administrator(s).
Technical and organisational measures regarding the transport, transfer, transmission, storage and subsequent review of Personal Data on data media (manually or electronically), so that Personal Data cannot be read, copied, changed or deleted without authorisation, during transfer or while stored on data media, and so that it can be monitored and determined as to which recipients a transfer of Personal Data is intended.
The transfer of Personal Data to a third party (e.g. customers, sub-contractors, service providers) is only made if a corresponding contract exists, and only for the specific purposes. If Personal Data is transferred to companies located outside the EEA, the Processor provides that an adequate level of data protection exists at the target location or organisation in accordance with the European Union's data protection requirements, e.g. by employing contracts based on the Standard Contractual Clauses.
Technical Vulnerability Management
Machines and equipment are monitored through a dedicated managed service.
All employees must get permission to install software outside of the standard suite.
We audit all systems on ongoing basis with at least yearly audits for critical systems.
Network Security Management
All networks (internal and external) are managed and secure with restrictions and access controls in place.
Segregation of networks are in place.
Policies for use of any information transfer system (such as Slack, Skype, Email etc.) are in place. All such systems require a personal invitation to be able to use them. NDA´s are always in place both for staff and 3rd parties and partners.
Sensitive information may only be shared internally between Mono employees in a dedicated and secure communication channel where data is deleted.
System acquisition, development and maintenance
Business requirements for new information systems, or enhancements to existing information systems must specify the requirements for security. Mono has the following security requirements for information systems.
Securing application services on public networks
All communications over public networks are encrypted using SSL/TLS to ensure integrity of the data and all traffic is monitored to ensure integrity of data.
Protecting application services transactions
Transactions are monitored and encrypted to ensure integrity of the transactions.
Security in development and support processes-
Secure development policy
Security by design is part of the development cycle, development do reviews to ensure best practices for development are adhered to.
System change control procedures
All changes are reviewed.
Technical review of applications after operating platform changes.
Technical reviews are in place
Restrictions on changes to software packages
A process is in place to ensure only necessary changes are done.
Secure system engineering principles
Mono are using security best practices to ensure secure development.
Secure development environment
All development work is done on local hardware with encrypted hard-disks
Mono only use outsourcing for non-critical tasks under secure procedure and environments. External providers do not have access to real data.
System security testing
As part of our deployment pipeline and QA process, security is tested.
System acceptance testing
As part of our deployment pipeline and QA we do system acceptance testing.
Protection of test data
All test-data is protected, in the same way as production data and kept separated from the production environment.
4. Data Entry Control
Technical and organisational measures regarding recording and monitoring of the circumstances of data entry to enable retroactive review.
System inputs are recorded in the form of log files therefore it is possible to review retroactively whether and by whom Personal Data was entered, altered or deleted.
5. Data Processing Control
Technical and organisational measures to differentiate between the competences of principal and contractor to provide that Personal Data is processed by a commissioned data processor in accordance with the Instructions of the principal.
Details regarding data processing control are set forth in the Agreement and DPA.
6. Availability Control
Technical and organisational measures regarding data backup (physical/logical):
Mono provides an API-based "snapshot" service, which allows for site restoration 30 edits back (default). In this case restoration is immediate. Additionally, Mono make server side backups daily for a week, and then weekly backups for a month, and then monthly backups for a minimum of 12 months. A Request for restoration from a backup is made by raising a ticket in our ticket system, JIRA.
Internal information Backups
All business critical information is stored on cloud solutions (Microsoft OneDrive).
Local content may or may not be part of a backup scheme (depending on the individual).
7. Separation Control
Technical and organisational measures regarding purposes of collection and separated processing:
Personal Data used for internal purposes only e.g. as part of the respective customer relationship, may be transferred to a third party such as a subcontractor, solely under consideration of contractual arrangements and appropriate data protection regulatory requirements.
Employees are instructed to collect, process and use Personal Data only within the framework and for the purposes of their duties (e.g. service provision). At a technical level, multi-client capability includes separation of functions as well as appropriate separation of testing and production systems.
Company Data is stored in a way that logically separates it from other customer data.
All data in transit is protected by Transport Layer Security (“TLS”).
8. Staff Integrity
Mono’s staff management policies aim to keep the integrity and security of information as high as possible.
The following pre-employment measures are taken in relation to every employee of Mono:
- A background check is carried out on all employees.
- A confidentiality agreement is included in the signed contracts of every Mono employee and/or contractor.
All employees are instructed and made aware of Mono’s information security policies and practices. This includes use of mobile devices and tele-working.
Policies for password strength and management are enforced on all employees systematically - for all systems, devices and equipment.
User-registration, de-registration and access and privilege provisioning is formalized and regularly reviewed.
Keys are managed and personal access to physical locations is logged.
Employees breaching the information security policies will be sanctioned.
Assets (equipment etc.) are returned on termination of an employee´s contract or the conclusion of the need for the use of the assets. (manuscript needed for this process)
Mono terminates all privileges and access rights.
Keys are returned to Mono.
9. Risk Assessment
Mono’s approach to security is based on recurring risk assessments where information security risks are identified and classified according to their potential damage and impact. Mono performs a general risk assessment annually and updates its security measures and controls accordingly to keep information security intact and up to date.
During the risk assessment process, each identified risk is classified in one of the following categories:
|Severity 1||Critical risk – requires immediate measures||Applies to sensitive information where unauthorized access (including internally) may lead to considerable damage for individuals (Sensitive information is here synonymous with being kept from public access).|
|Severity 2||Considerable risk – requires short term action||Applies to information which may harm or be inappropriate for external parties to gain knowledge of.|
|Severity 3||Moderate risk – requires action but not urgently||Applies to data where access is restricted or “hard to get” but in no sense sensitive.|
|Severity 4||Low risk – no action required||Applies to publicly available / open or common data|
Disruptive threats are highly unlikely but could occur and affect the normal business process. Mono has considered a wide range of potential threats and the results of our deliberations are included in this section. Each potential environmental disaster or emergency situation has been examined. The focus here is on the level of business disruption which could arise from each type of disaster.
Potential disasters have been assessed as follows:
|Potential Disaster||Probability Rating||Impact Rating||Brief Description Of Potential Consequences & Remedial Actions|
|Flood||4||4||All critical equipment is located on 1st Floor|
|Fire||4||4||Gas-based fire suppression systems installed in data centers. Fire and smoke detectors on all floors.|
|Act of terrorism||4||5||All systems and data mirrored in multiple locations|
|Act of sabotage (including DDoS attacks)||4||4||All systems and data mirrored in multiple locations. DDoS attacks are mitigated smoothly and efficiently by switching to another IP range.|
Electrical power failure
|5||4||Each data center has full power backup in case of an outage. Generators, in combination with UPS systems, guarantee availability.|
|Loss of communications network services||4||4||Two diversely routed T1 trunks into building. WAN redundancy, voice network resilience|
Probability: 1=Very High, 5=Very LowImpact: 1=Total destruction, 5=Minor annoyance
10. Disaster Recovery
Crisis Response Team
A crisis response team is in place to provide the framework for the appropriate response to a disaster. The team will define the degree of involvement by the various members of the staff.
The objectives of the team include avoiding death or injuries, control and terminating any incident as soon as possible, minimizing commercial and reputational damage, protecting our partners and their clients, protecting our own assets and financial position, minimizing our legal liabilities, recovering disrupted business functionality as soon as possible.
The crisis response team is also responsible for raising awareness and training throughout the organization.
Declaring a Disaster
If the crisis response team finds a disaster likely to have a critical impact on one of our partners or their clients (“End Users,”) then the crisis response management will characterize the extent of disaster/expected interruption, and act accordingly.
Disasters may have - or potentially have - any one or more of the following characteristics:
- A Service or Solution is not available;
- Major functionality or a major component of a Service or Solution is not available, accessible or operable by End Users and there is no work around; or
- A defect materially impacts on one or more of a partner’s products or services (including the website product).
Check List for crisis response
In case of a disaster, the response team will follow this checklist for the declaration and response to the situation:
- Initial assessment of the problem
- Extent of damage
- Who should report to work if during non-business hours
- Where and when to report to work
- Who will contact partners/clients
- Who will contact suppliers/vendors
- Information about employees’ personal belongings at work
- When more detailed information will be available.
- Who handles media contact
Disaster Affecting the Solution & Data or Hosting Location
Any single component of the Solution is backed up at redundant locations and detailed response procedures and monitoring systems are in place for different types of outages.
The Solution is hosted at maximum security facilities in Copenhagen and directly linked with a duplicate server setup in Luxemburg which mirrors the Copenhagen Server and is used in fail-over situations.
The Site Editor and the API is served from multiple locations. Sites and site data is backed up centrally as well.
Disaster Affecting Mono Offices
Mono has a fully operational setup that allows all employees to work from their own home. In case a disaster hits any of the Mono Offices, employees will be notified by phone to work from their own home.
11. Data Breaches
Mono keeps logs of data breaches and has a clear policy for data breach notification.