Security

All communication (network traffic) between servers and client machines are protected with strong SSL encryption.

Login passwords are not stored anywhere. Password hashes uses one way salted hashing algorithms, according to best practices (specifically, we are using scrypt).

Secret session keys (to store server session data client side) uses encrypted JSON Web Tokens (unreadable to the client).

Please note that we are currently in the process of migrating login, authentication and authorization to using a Standalone Identity Provider (IdP) with full OpenID Connect and OAuth 2.0 protocol implementation. The service supports all major login and authentication flows enabling i.e. SSO and Bearer Token based API access to mention a few typical scenarios

All data is stored in a PostgreSQL database. This database is not “exposed” directly to the network (external world) in any way. Only access through the server APIs is possible.Database access is only done using parameterized queries, meaning the service is immune to classical SQL injection attacks.

System level access is only possible through SSH and the control panel of the hosting provider (currently Digital Ocean, hosted in the AMS2 cluster in Amsterdam).

Application data is stored and granted using three layers of security, company level, user level and dataset level. These access levels are enforced by the server API layer. Generally, all users in a company share access to all data within the company they belong to. Individual dataset access can be controlled at a per-user level (one user in a company can specify which other individual users are allowed to read or modify a dataset). Single users may be granted access to multiple companies if necessary (consultants working for multiple oil companies and similar).

Some customers, for various reasons, requests us to provide private cloud or internally hosted instances of our service for individual clients. This is easily achievable, but increases costs as we need to operate additional server clusters than our own. Exact pricing would depend on whether clients host services in the cloud themselves (where our access should be easy to grant), or if they run it inside protected private data centers (where our access would typically be complicated).