Secure by design

Cezanne HR is designed around a multi-tiered architecture that is recommended for web-based applications. The architecture partitions application functionality into independent layers: the presentation layer (or browser client), the business logic (application server) and the data layer (database).

The presentation layer never communicates directly with the database layer. All communication is performed via the business logic, which provides its own security checks before permitting access to the data. This prevents requests from a web browser from going directly to the database. The application also verifies the user role at every request.

The system encrypts customer data both at rest and in transmission using Transport Layer Security (TLS), which provides end-to-end security for communication between layers and across the internet and AES 256 for data encryption at rest.

Secure mechanisms are used to verify the identity of users attempting to access the system. In order to access the system, the user must either enter a username (e-mail address) and password or authenticate through an approved Single Sign-On (SSO) provider. For additional security, customers can also opt to use dual authentication, also known as multi-factor authentication or 2FA.

Passwords are protected using sophisticated hashing and salting techniques; Cezanne HR only ever stores hashes of password, never the passwords themselves.

You can set rules in the system to enforce a strong password policy, including:
- Mandatory inclusion of at least one upper and lowercase letter, one number and one symbol.
- Minimum and maximum password length.
- Expiry dates with reminders.
- Password history to prevent users from re-using their passwords within a customer-defined period.
- Maximum number of failed login attempts before the account is temporarily locked.
- You can also choose which, if any, of the Single Sign-On options – e.g. Google, Microsoft, Twitter, Facebook and OpenID – are available to your users. Only identifiers that are secured with SSL can be used when the OpenID SSO option is enabled.

User authorisation is controlled through dynamic role-based security. Employees are allocated to roles, such as HR administrator, restricted HR administrator, line manager or self-service employee. The system then dynamically allocates permissions to individual users to view, change or delete information, or access different areas of functionality, based on their responsibilities in the company. For example, line managers can see more information about the employees that report to them than those employees who do not.

Importantly, Cezanne HR has been developed with embedded business intelligence functionality. This means that access to dashboards, queries and data exports are controlled by the same rules as those that govern access to features or information in the database.

Cezanne HR's Information Security Management System (ISMS) for the development, operation and delivery of the Cezanne HR service is ISO 27001 certified by BSI under certificate number IS 696606.

Cezanne HR is also Cyber Essentials Certified. Cyber Essentials is a UK government information assurance scheme operated by the National Cyber Security Centre that encourages organisations to adopt good practice in information security.

We are compliant with the provisions of articles 28(1), 32(1) and 32(2), in the sense that we have implemented “appropriate technical and organisational measures in such a manner that processing will meet the requirements of the Regulation”. The measures implemented include, but are not necessarily limited to, the following:
- all data are encrypted both at rest and in transmission;
- all accesses to the system are monitored and logged (both successful logins and attempted logins);
- all modifications of personal data are timestamped and tracked in a log;
- personal data belonging to the controller are only stored in cloud locations within the AWS service that offer high physical and logical access protection, including cybersecurity against viruses, malware and denial-of-service attacks;
- ongoing confidentiality of data is assured by state-of-the-art authentication methods, which the controller can tune as required (in terms of password length, composition and duration);
- ongoing availability of data is assured by constant monitoring of the system in multiple locations world-wide and rapid response processes in case of system stress or other performance issues;
- resilience of processing systems is assured by use of multiple data centres and of mirror copies of databases;
- the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident is assured by an appropriate backup/recovery procedure, which is periodically tested;
- the protection against unauthorised access to personal data is constantly checked through penetration testing performed by a reputable cybersecurity organisation;
- all security measures are regularly reviewed, also in light of the evolution of the technology and the cybersecurity industry.

We are compliant with the provisions of articles 28(2) and 28(3) because we have revised our Terms and Conditions to include all of the provisions that the law requires.

We are compliant for what concerns the physical location of data, as the agreement in place with our hosting provider, AWS guarantees that data will never leave the AWS region of Ireland, and the potential access to data by Cezanne HR’s support personnel is, in any case, limited to access from the UK or from other EEA countries.

We have data processing agreements with all sub-processors are fully consistent with all the commitments we have with customers, including the assurance that no personal data is ever transferred or processed outside the EEA.

We are also compliant with other aspects of the GDPR, such as:

- We have procedures in place to manage potential data breaches;
- We are committed to assisting our customers in case of data subject request;
- We are open to audits and inspections if requested;
- All our personnel that may have access to customers’ personal data is fully trained in data security and protection and is bound by confidentiality agreements;
- We have procedures in place to return and/or erase all personal data of customers that have terminated their subscription to the system.

Although the law doesn’t strictly require it in our case, we maintain the formal records in accordance with article 30(2) of GDPR.

We have appointed a data protection officer in accordance with article 37(1) of GDPR. The appointment has been registered with the ICO.

Although it is not a GDPR requirement but only a facilitator to prove compliance, our Information Security Management System (ISMS) is approved for certification in accordance with ISO27001:2013 standards with the UK's leading accreditation body, BSI.