Security / trust page (technical measures) — Conceptboard

Cited by

Facts read from this source

• Entity Report an error

  “we – the Conceptboard Cloud Service GmbH, Mansfelder Str. 56, 06108 Halle (Saale), Germany – meet with the customer”

• Pseudonymization Report an error

  “Personal data is stored and merged using a pseudonymized user identification number (user ID).”

• Encryption in transit Report an error

  “TLS1.2, 256-bit AES in GCM with elliptic curve cryptography and forward secrecy are used”

• Encryption at rest Report an error

  “Stored customer data is encrypted with symmetrical AES256 keys.”

• Password storage Report an error

  “User passwords are not saved. Instead, a secure method based on cryptographic hash functions is used (“Salted Cryptographic Hash”).”

• Data centers Report an error

  “the data centers of IONOS and Amazon Web Services (AWS) in the Frankfurt, Germany region”

• Network segmentation Report an error

  “completely separated from each other by separate networks and network segments. Networks and network segments are protected by restrictive firewall rules.”

• Admin access Report an error

  “Administrative access is only possible via secure connections (VPN with end-to-end encryption, separate management networks, 2FA) and is logged in log files.”

• Access control Report an error

  “The principle of the lowest allocation of rights (“need-to-know principle”), after users only receive the access that is necessary for the fulfillment of their tasks, is used.”

• Backup Report an error

  “Productive data is backed up daily as a full backup. All backups are kept redundant in cold standby mode, have automated fail over and in encrypted form (AES256) – unless otherwise agreed or otherwise documented, 2 availability zones, German region-”

• Disaster recovery Report an error

  “Disaster recovery processes to restore data and processes for randomly checking the recoverability are defined.”

• Incident management Report an error

  “Procedures for handling and reporting incidents (incident management) including the detection and reaction to possible security incidents are defined.”

• Employee training Report an error

  “Conceptboard provides information security awareness training to its employees”

• Penetration testing Report an error

  “Constant security audits of the service are carried out by independent IT security experts as part of a Bug Bounty Program. These tests include automated and manual penetration tests.”

• ISO certifications Report an error

  “Third parties perform audits and attest to ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019 compliance standard annually.”

• Vulnerability management Report an error

  “Security measures include: anti-virus / anti-malware, vulnerability scanning, threat notification advisories, patch management.”

• Hiring checks Report an error

  “Conceptboard performs employment verification, including validation of proof of identity, for new hires in positions that require access to systems and applications that store customer information.”

• DPA signed copy Report an error

  “In case you need a signed copy of the DPA (inclusive TOM), please contact us.”

• Language Report an error

  “This statement was written in German. If you are facing inconsistencies between the translated version of this statement compared to the German version, always the German version shall prevail.”

• Deployment Report an error

  “The commissioning of the productive systems provided, their configuration and the import of changes are carried out traceably and transparently via an automated deployment infrastructure (“infrastructure-as-code principle”).”

Scores citing this record

• The Microsoft 365 Admin Security, AI controls & deployment
• The Microsoft 365 Admin European sovereignty
• The Product Team Lead Security, AI controls & deployment
• The Public-Sector Project Lead Security, AI controls & deployment
• The Public-Sector Project Lead European sovereignty
• The Skeptic Security, AI controls & deployment
• The Skeptic European sovereignty
• The Works Council Member Security, AI controls & deployment
• The Works Council Member European sovereignty
• The Workshop Facilitator Security, AI controls & deployment
• The Workshop Facilitator European sovereignty