Safespring: Comprehensive GDPR Protection Beyond Third-Country Transfer

Log Management and Security Measures

Protection against internal and external active/aggressive expertise: Safespring currently has effective debugging and system logging.

Safespring’s recommendation to our customers

Our recommendation is to use established industry tools for intrusion detection and audit logging. Store logs both locally and centrally, and use tools to identify normal log patterns.

This contributes to maintaining GDPR’s requirements on

• integrity (A5.1.f),

• confidentiality (A5.1.f), and

• accountability (A5.2), as well as

• security measures for confidentiality and integrity (32.1.b).

User Management and Access Control

Protection against internal Passive/Neutral Expert: To manage risks associated with employees’ mistakes or role changes, Safespring carefully manages user access. All accounts must be individual.

Safespring’s recommendation to our customers

Our recommendation is to remove individual accounts when employees leave or change roles. This includes using timed permissions for applications and the ability to force data storage on a server one connects to securely to prevent sensitive files from being stored locally on the user’s workstation.

This contributes to maintaining GDPR’s requirements on

• accuracy (A5.1.d),

• data minimization (A5.1.e),

• integrity (A5.1.f), and

• security measures for access (A32.1.b).

Data Encryption

Safespring implements “encryption at rest” by using disk encryption on all disks in its data centers, helping the customer secure personal data

stored on the platform in accordance with GDPR. Encryption at rest and in transit is crucial to ensure data remains secure. Safespring applies at least “TLS 1.2” for communication to and from all services.

Safespring’s recommendation to our customers

Our recommendation is to establish a “zero-knowledge” architecture, where data is encrypted before being sent to Safespring’s platform, where applicable. Safespring’s Backup service has this functionality built in as an option that automates encryption. For storing less sensitive data, customers can also rely on Safespring’s built-in encryption at rest.

This complies with GDPR’s requirements on

• built-in data protection (A25.2),

• confidentiality (A5.1.f).

Backup and Recovery

Protection against physical and technical incident management: Safespring implements key measures to ensure the availability and recovery of customer data. We offer a robust backup solution for our internal services and environments, but it is important to note that we do not back up customer-entered data. Customers are encouraged to ensure their data is backed up to restore availability and access to personal data when needed. Our backup service is a valuable option that facilitates customers in meeting this recommendation.

Safespring’s recommendations to our customers

Our recommendation is to actively manage the backup and redundancy of their data. By using our backup service and taking advantage of our robust block storage, customers can ensure high availability and quick recovery of their data.

This complies with GDPR’s requirements on

• availability,

• recoverability, and

• resilience of processing systems and services (A32.1.c).

Security Audit and Policy Update

Policy documents and revisions: Safespring has several policy documents and security guides, which means we regularly update and revise our security policies.

Safespring’s recommendations to our customers

Our recommendation is to regularly update and revise their own security policies to ensure that established routines are followed or to update routines so they reflect the business in practice.

This complies with GDPR’s requirements on

• regularly testing, assessing, and evaluating the effectiveness of technical and organizational measures to ensure the security of processing (Article 32).

Redundancy

Protection against physical and technical failure or ransomware

Central block storage for increased redundancy: As part of our service, we offer central block storage to Safespring Compute, where data is stored in three copies across a cluster, minimizing dependence on specific hard drives. This measure is crucial to ensuring data access and recovery in the event of technical failure.

This complies with GDPR’s requirements on

• the resilience of processing systems and services (32.1c)