At clixifix® our primary operation is the management, development and support of our software as a solution application.
This software application was specifically written to provide a collaborative platform for our clients to effectively manage their Customer care activities in the housebuilding construction sector.
Security
The clixifix® web application is hosted on Heroku. Heroku see https://www.heroku.com/about owned by Salesforce,
see https:www.salesforce.com/uk/products/platform/products/heroku/ sits on top of Amazon’s infrastructure.
Security:
clixifix® is currently working towards the ISO 27001 accreditation. We are accredited to Cyber Essentials +
Also -Heroku state in https://www.heroku.com/policy/security that :
“Heroku’s physical infrastructure is hosted and managed within Amazon’s secure data centers and utilize the Amazon Web Service (AWS) technology. Amazon continually manages risk and undergoes recurring assessments to ensure compliance with industry standards. ‘’
Amazon’s data center operations have been accredited under:
Also see http://aws.amazon.com/compliance/ for further information.
AWS Region and Endpoint location.
To reduce data latency in our application, Amazon Web Services offer a regional endpoint to make our requests.
Current Region and Endpoints is EU (Ireland) eu-west-1 -located in Dublin.
Our postgres and S3 data is at rest in this location.
We take reasonable endeavours to ensure that any third parties provide an adequate level of protection in relation to any data transfers outside this region when the data is not at rest.
Business Continuity.
clixifix® does not carry the ISO 25999 certification.
clixifix® is hosted on Heroku’s cloud platform based on Amazon’s hardware and data centres. clixifix® runs inside many Heroku dynos -isolated, virtualised Unix containers.
Dynos are constantly monitored and in the event of a system crash the application will be automatically restarted elsewhere in the infrastructure.
Additionally, extra dynos can be started as required to handle increased application load.
The database is based on postgres.
Continuous Protection Systems
We maintain point in time recovery of critical production databases for 7 days.
This system uses the WAL to give us atomic level recovery options.
Scheduled Logical Backups
The automated system will generate backups according to the schedule above without intervention.
We have a Data Review Board that meets on the 1st week of every month to review retained data.
Additionally, Heroku perform continuous protection by creating a base physical backup and using write ahead log (WAL) files to allow for replay of data in case of an outage –
see https://devcenter.heroku.com/articles/heroku-postgres-data-safety-and-continuous-protection.
Files are stored in Amazon S3.
S3 “redundantly stores data in multiple facilities and on multiple devices within each facility”
-see http://aws.amazon.com/s3/details/#durabilityfor details.
Lastly, all interactions with the application from requesting a web page, uploading a file is logged and these logs are monitored.
All of the above is in place to reduce the risk of a disaster and to ensure that business does continue.
To provide further resilience, we are currently reviewing the implementation of a:
* 2nd copy of the application in a physically separate hosting application such as Azure or similar.
* Database follower in a physically separate Amazon zone or alternative hosting environment.
System that is completely separate from Amazon/Heroku but is in sync.
Data Security.
Our license agreement states the following:
“We shall process any personal data in compliance with all applicable laws, enactments, regulations, orders, standards and other similar instruments.”
“We shall take appropriate technical and organisational measures against the unauthorised or unlawful processing of personal data and against the accidental loss or destruction of, or damage to, personal data to ensure our compliance with the seventh data protection principle.
”You are responsible for Your Customers’ use of the Services and ensuring that you have appropriate terms and policies in place with Your Customers detailing how they may use the Services and how their Personal Data may be processed by you (and by us on your behalf).”
Data Return procedures.
On request we will provide data in zip folder containing the data in excel format for the Scheme / Contract / Plot / contacts/ Tickets / Inspection and associated commentary.
We can also provide all supporting media files in the format they were provided / uploaded by separate request.
Our licence agreement states:
”We may destroy or otherwise dispose of any of your data in our possession unless we receive, with your notice to terminate, or where we terminate, prior to the end of the Trial Period or the current contract period, a written request for the delivery to you of the then most recent back-up of your data. We shall use reasonable commercial endeavours to deliver any back up to you within 28 days of receipt of such a written request, provided that you have, at that time, paid all fees and charges outstanding at and resulting from termination.
You shall pay all reasonable expenses incurred by us in returning or disposing of your data ”
