Security Settings

Learn more about our Security settings

Security settings

Last updated: April 2019

Technical and Organisational Security Measures

All data is stored in highly secure environments that are protected from unauthorized access and accidental destruction or damage. Data security is safeguarded by a set of policies and access controls which are summarized in this Security Policy.

Hosting

The Solution and the websites created via the Solution are hosted under managed services arrangements with industry leading vendors and with back-up and redundancy arrangements designed to avoid data loss or service interruption notwithstanding a disaster disabling the primary hosting facility.

The Mono Server setup is built to scale with multiple locations around the Globe. This ensures maximum site- & editor performance from any location in the world.

The 2 main elements of the set up are:

• Central Server Center & fail-over
• Local Server Centers (CDN)

The Server Centers 

The Solution is hosted at maximum security facilities in Denmark, Canada and Germany. The Site Editor, the websites and the site API is served from Denmark, Canada and Germany. Sites and site data are backed up on each location as well as a separate off-site backup based in Copenhagen. Secure failover processes for all data is in place.

Premium Data Center Facilities 

Maintained round the clock by highly trained staff, the data centers are designed and equipped to the highest industry standards - raised floors, automatic fire extinguishing equipment, AC and DC power distribution, uninterruptible power supplies (UPS), backup generators and multiple redundant fiber connections to all major carriers.

ISO Certification 

The data centers we use have all received the internationally recognized ISO 27001 certification and Certification for information security management systems.

Guaranteed power

Each data center has full power backup in case of an outage. Generators, in combination with UPS systems, guarantee maximum availability.

Temperature control

All Hosting facilities are equipped with redundant cooling equipment. Down-flow cooling units guarantee maximum cooling for your equipment. Room temperature is maintained at 18 to 25 C with a humidity level of 40% - 60%.

Security

Every data centre is equipped with a state-of-the-art security system to prevent unauthorized access to equipment. With proximity cards, typically combined with biometric readers and mantraps, access is limited to authorised personnel.

Building management systems

All data centre related equipment, such as cooling equipment, electrical systems and fire control systems, is monitored around the clock. All events are controlled and procedures are in place to react to every possible incident 24 hours a day, 7 days a week, year round.

Fire protection

All data centers are equipped with fire detection and gas-based fire suppression systems as a first line defence against fire. Argon, FM-200 or CEA is used across our all facilities. (The type of gas used depends on the local fire regulations.) These systems are automatic and monitored continuously (24 x 7). All buildings are equipped with hand-held CO2 fire extinguishing systems, as required by local fire regulations.

Content Delivery Network

All Mono sites are hosted on a secure and multi-redundant Content Delivery Network (CDN).  This includes generated (cached) content of the individual websites.

The CDN has multiple nodes and fall-back nodes located across North America, Europe, Asia and Australia. The CDN ensures optimized load speed for both the editor and sites no matter where they are located. This CDN also lowers latency and ensures maximum uptime of customer sites as each node acts as a local fail-over server.

List of current Locations in CDN (more locations are being added on on-going basis):

• Chicago (fail over node)
• Dallas (fail over node)
• Toronto
• Frankfurt
• Copenhagen (fail over)
• Singapore
• Sydney

Security & IP Technology

Mono operates with our own IP range which provides our CDN set up with further protection from DDoS attacks as well as fast and secure failover procedures.

Reseller specific IPs is also an option anywhere.

The Solution

The platform runs on an optimized PHP code base, which is updated and sanitized on an ongoing basis.

The high stability and availability of the platform is unprecedented among industry standards.

1. ENTRANCE CONTROL

Technical or organisational measures regarding access control, especially regarding legitimation of authorised persons. 

Security of the Physical Environment 

The physical environment and facilities are designed to prevent unauthorized access to or damage to the Company´s Data: 

• All system servers with information that require protection are kept in high security areas at external hosting facility where access is highly restricted.
• IT equipment in the Mono office area is safeguarded by a locked door policy and appropriate security system (intruder alarm and fire alarm). 
• The Mono office area is safeguarded by an electronic access control system. 
• All external doors and windows must be closed and locked at the end of the work day. 
• All employees are trained in operating the office security systems.

Security of Equipment, devices and media

All Solution assets are carefully protected to ensure maximum security: 

• All assets are recorded in a central asset inventory which is kept updated monthly.
• All hardware assets are owned by Mono – Mono does not borrow, rent or lease equipment.
• Employees in possession of equipment are educated in the acceptable use hereof. This includes instructions on safe-travelling with laptops, removable hard disks and mobile phones. In general, equipment must always be carried as hand-baggage and never left out of sight during travelling. The same policy applies to laptops being transported home for remote working purposes. 
• Employees are instructed in safe use of all removable media devices such as external hard disks, USB keys which could carry malware etc. 
• Deprecated equipment is being safely deposited for destruction, so that access to any information stored on this equipment is prevented.

2. System Access Control

Technical and organisational measures regarding the user ID and authentication aimed to prevent unauthorised use of data processing systems, used for the processing of Company Data: 

Access Control and User Access Management

Access to any system carrying information is strictly safeguarded and subject to these security procedures: 

• Access control to each system is documented and maintained by the administrator of that system.
• Each system has differentiated access rights/roles (where relevant) that only allow users to access the information which is required and appropriate for their role.
• Registration and de-registration of user access rights is maintained by the administrator of that system.

System and application access control

All mono employees have responsibility to adhere to Mono’s policies and practices for secure authentication and access: 

• Only the administrator can override application access controls.
• Source code access control is limited to individuals and controlled by the system admin and access is logged on the server.

Protection from Malware

All mono employees have responsibility to install anti-virus / malware protection client.

• Users are instructed in how to install software.
• Users are instructed on how to act on security warnings.
• Users are instructed to update their software frequently.

3. DATA ACCESS CONTROL

Technical and organisational measures regarding the on-demand structure of the authorisation concept, data access rights and monitoring and recording of the same:

Logging and monitoring 

Mono logs everything to be able to trace breaches and unauthorized access of any kind. 

Servers 

All serves have logs (access, system (OS) & application logs).

Mono has a Central Log repository in place, where it is possible to search through and monitor all logs 30 days back.

Logs are locked and protected from tampering.

All servers are synchronized (clock / UTC).

Administrator and operator access to servers is logged and access control are limited to the appointed administrator(s).

Transmission Control

Technical and organisational measures regarding the transport, transfer, transmission, storage and subsequent review of Personal Data on data media (manually or electronically), so that Personal Data cannot be read, copied, changed or deleted without authorisation, during transfer or while stored on data media, and so that it can be monitored and determined as to which recipients a transfer of Personal Data is intended.

The transfer of Personal Data to a third party (e.g. customers, sub-contractors, service providers) is only made if a corresponding contract exists, and only for the specific purposes. If Personal Data is transferred to companies located outside the EEA, the Processor provides that an adequate level of data protection exists at the target location or organisation in accordance with the European Union's data protection requirements, e.g. by employing contracts based on the Standard Contractual Clauses.

Technical Vulnerability Management 

Machines and equipment are monitored through a dedicated managed service. 

All employees must get permission to install software outside of the standard suite. 

We audit all systems on ongoing basis with at least yearly audits for critical systems. 

Network Security Management

All networks (internal and external) are managed and secure with restrictions and access controls in place.

Segregation of networks are in place.


Information Transfer

Policies for use of any information transfer system (such as Slack, Skype, Email etc.) are in place. All such systems require a personal invitation to be able to use them. NDA´s are always in place both for staff and 3rd parties and partners.

Sensitive information may only be shared internally between Mono employees in a dedicated and secure communication channel where data is deleted.


System acquisition, development and maintenance

Business requirements for new information systems, or enhancements to existing information systems must specify the requirements for security. Mono has the following security requirements for information systems.


Securing application services on public networks

All communications over public networks are encrypted using SSL/TLS to ensure integrity of the data and all traffic is monitored to ensure integrity of data.



Protecting application services transactions

Transactions are monitored and encrypted to ensure integrity of the transactions. 

Security in development and support processes-


Secure development policy

Security by design is part of the development cycle, development do reviews to ensure best practices for development are adhered to.


System change control procedures

All changes are reviewed.

Technical review of applications after operating platform changes.


Technical reviews are in place

Restrictions on changes to software packages

A process is in place to ensure only necessary changes are done.


Secure system engineering principles

Mono are using security best practices to ensure secure development.


Secure development environment

All development work is done on local hardware with encrypted hard-disks


Outsourced development

Mono only use outsourcing for non-critical tasks under secure procedure and environments. External providers do not have access to real data.


System security testing

As part of our deployment pipeline and QA process, security is tested.


System acceptance testing

As part of our deployment pipeline and QA we do system acceptance testing.


Protection of test data

All test-data is protected, in the same way as production data and kept separated from the production environment.

4. Data Entry Control 

Technical and organisational measures regarding recording and monitoring of the circumstances of data entry to enable retroactive review.

System inputs are recorded in the form of log files therefore it is possible to review retroactively whether and by whom Personal Data was entered, altered or deleted.

5. Data Processing Control

Technical and organisational measures to differentiate between the competences of principal and contractor to provide that Personal Data is processed by a commissioned data processor in accordance with the Instructions of the principal.

Details regarding data processing control are set forth in the Agreement and DPA.

6. Availability Control 

Technical and organisational measures regarding data backup (physical/logical): 

Site Backups

Mono provides an API-based "snapshot" service, which allows for site restoration 30 edits back (default). In this case restoration is immediate. Additionally, Mono make server side backups daily for a week, and then weekly backups for a month, and then monthly backups for a minimum of 12 months. A Request for restoration from a backup is made by raising a ticket in our ticket system, JIRA.


Internal information Backups

All business critical information is stored on cloud solutions (Microsoft OneDrive).


Local Machines

Local content may or may not be part of a backup scheme (depending on the individual).

7. Separation Control

Technical and organisational measures regarding purposes of collection and separated processing:

Personal Data used for internal purposes only e.g. as part of the respective customer relationship, may be transferred to a third party such as a subcontractor, solely under consideration of contractual arrangements and appropriate data protection regulatory requirements.

Employees are instructed to collect, process and use Personal Data only within the framework and for the purposes of their duties (e.g. service provision). At a technical level, multi-client capability includes separation of functions as well as appropriate separation of testing and production systems.

Company Data is stored in a way that logically separates it from other customer data.

All data in transit is protected by Transport Layer Security (“TLS”).

8. Staff Integrity 

Mono’s staff management policies aim to keep the integrity and security of information as high as possible. 

Pre-employment

The following pre-employment measures are taken in relation to every employee of Mono: 

• A background check is carried out on all employees.
• A confidentiality agreement is included in the signed contracts of every Mono employee and/or contractor. 

During employment:

All employees are instructed and made aware of Mono’s information security policies and practices. This includes use of mobile devices and tele-working. 

Policies for password strength and management are enforced on all employees systematically - for all systems, devices and equipment. 

User-registration, de-registration and access and privilege provisioning is formalized and regularly reviewed. 

Keys are managed and personal access to physical locations is logged. 

Employees breaching the information security policies will be sanctioned. 

Post employment:

Assets (equipment etc.) are returned on termination of an employee´s contract or the conclusion of the need for the use of the assets. (manuscript needed for this process) 

Mono terminates all privileges and access rights. 

Keys are returned to Mono.

9. Risk Assessment

Mono’s approach to security is based on recurring risk assessments where information security risks are identified and classified according to their potential damage and impact. Mono performs a general risk assessment annually and updates its security measures and controls accordingly to keep information security intact and up to date.

During the risk assessment process, each identified risk is classified in one of the following categories:

Disruptive threats are highly unlikely but could occur and affect the normal business process. Mono has considered a wide range of potential threats and the results of our deliberations are included in this section. Each potential environmental disaster or emergency situation has been examined. The focus here is on the level of business disruption which could arise from each type of disaster.

Potential disasters have been assessed as follows:

Probability: 1=Very High, 5=Very LowImpact: 1=Total destruction, 5=Minor annoyance

10. Disaster Recovery 

Crisis Response Team

A crisis response team is in place to provide the framework for the appropriate response to a disaster. The team will define the degree of involvement by the various members of the staff. 

The objectives of the team include avoiding death or injuries, control and terminating any incident as soon as possible, minimizing commercial and reputational damage, protecting our partners and their clients, protecting our own assets and financial position, minimizing our legal liabilities, recovering disrupted business functionality as soon as possible. 

The crisis response team is also responsible for raising awareness and training throughout the organization.

Declaring a Disaster

If the crisis response team finds a disaster likely to have a critical impact on one of our partners or their clients (“End Users,”) then the crisis response management will characterize the extent of disaster/expected interruption, and act accordingly.

Disasters may have - or potentially have - any one or more of the following characteristics:

• A Service or Solution is not available; 
• Major functionality or a major component of a Service or Solution is not available, accessible or operable by End Users and there is no work around; or 
• A defect materially impacts on one or more of a partner’s products or services (including the website product).

Check List for crisis response 

In case of a disaster, the response team will follow this checklist for the declaration and response to the situation:

1. Initial assessment of the problem
2. Extent of damage 
3. Who should report to work if during non-business hours 
4. Where and when to report to work 
5. Who will contact partners/clients 
6. Who will contact suppliers/vendors 
7. Information about employees’ personal belongings at work 
8. When more detailed information will be available. 
9. Who handles media contact

Disaster Affecting the Solution & Data or Hosting Location 

Any single component of the Solution is backed up at redundant locations and detailed response procedures and monitoring systems are in place for different types of outages.

The Solution is hosted at maximum security facilities in Copenhagen and directly linked with a duplicate server setup in Luxemburg which mirrors the Copenhagen Server and is used in fail-over situations.

The Site Editor and the API is served from multiple locations. Sites and site data is backed up centrally as well.


Disaster Affecting Mono Offices

Mono has a fully operational setup that allows all employees to work from their own home. In case a disaster hits any of the Mono Offices, employees will be notified by phone to work from their own home.

11. Data Breaches 

Mono keeps logs of data breaches and has a clear policy for data breach notification.