Overholdelse

ISO

Vores datacenter er certificeret ISO 27001, 27017, 27018. For mere information se detaljer fra vores hostingpartner .

ISO 27001 er en bredt anerkendt og internationalt accepteret informationssikkerhedsstandard, der specificerer sikkerhedsstyrings bedste praksis og omfattende sikkerhedskontrol efter ISO 27002 vejledning om bedste praksis.

ISO 27017 er en standard, der giver yderligere vejledning og implementeringsrådgivning vedrørende informationssikkerhedsaspekter, der er specifikke for cloud computing.

ISO 27018 fastlægger almindeligt accepterede kontrolmål, kontroller og retningslinjer for implementering af foranstaltninger til beskyttelse af personligt identificerbar information (PII) i overensstemmelse med definerede fortrolighedsprincipper for offentlige cloud computing-miljøer.

GDPR

Som et norsk firma overholder vi fuldt ud GDPR. Du kan finde vores politikker vedrørende fortrolighed og databehandling i vores servicevilkår . Kontakt os for en liste over vores underprocessorer.

Den generelle databeskyttelsesforordning (EU) 2016/679 (GDPR) er en forordning i EU-lovgivning om databeskyttelse og privatlivets fred i Den Europæiske Union (EU) og Det Europæiske Økonomiske Samarbejdsområde (EØS). Den vedrører også overførsel af personoplysninger uden for EU og EØS-områderne.

SOC

Rapporter om sikkerhed, tilgængelighed og fortrolighed. For flere oplysninger se detaljer fra vores hostingpartner .

SOC1 Type 2 er en uafhængig undersøgelse af IT-generelle kontroller og kontroller omkring tilgængelighed, fortrolighed og sikkerhed af kundedata, der er behandlet, der er relevante for kundernes økonomiske rapportering.

Den begrænsede anvendelse af SOC2 Type 2-rapporten er en uafhængig undersøgelse af præsentationens retfærdighed og egnetheden af designet af kontroller, der er relevante for sikkerhed, tilgængelighed og fortrolighed af de behandlede kundedata.

SOC3-rapporten om almindelig brug er en uafhængig undersøgelse af retfærdigheden i præsentationen og egnetheden af designet af kontroller, der er relevante for sikkerhed, tilgængelighed og fortrolighed af de behandlede kundedata.

PCI DSS

MakePlans gemmer ikke kreditkortoplysninger, men stoler på certificerede partnere for sikker transmission og opbevaring.

PCI DSS er den globale sikkerhedsstandard for alle enheder, der gemmer, behandler eller transmitterer kortholderdata og / eller følsomme godkendelsesdata

Secure Development

Access Control

MakePlans treats security as a top priority. Our access granting process is designed to follow the principle of least privilege and we authenticate using SSO with hardware tokens as a mandatory second factor.

Device Security

We standardize on macOS devices. All devices are encrypted, and secure device configuration is enforced.

Development Process

We use a pull-request based approach with code reviews and CI/CD pipelines. Every change is tested with automated tests, dependencies are checked for known vulnerabilities, and the code is scanned for security issues.

Infrastructure Security

Hosted on AWS

Our infrastructure is hosted on AWS, which maintains internationally recognized compliance certifications (including ISO 27001 and SOC 2). They maintain industry-leading security practices and provide best-in-class environmental and physical protection for the services and infrastructure. Learn more about AWS security on their Cloud Security page.

Data Encryption

All data is encrypted at rest and in transit. We regularly scan our TLS configuration and ensure that our services only allow HTTPS traffic with HSTS enabled.

Separation of Environments

Non-production environments are separated from production, both in terms of network and access control. Production data is never used for testing purposes.

Audit Logging

We make sure to collect logs from our services to ensure proper auditing without logging sensitive data.

High Availability

Our infrastructure is designed for high availability. Data is backed up to multiple locations for at least 30 days, and we have disaster recovery plans that are tested regularly.

Subprocessors

We perform due diligence on all data processors and minimize the number of third parties involved. A list of our subprocessors is available.

Organization Security

Personnel

MakePlans has a small, highly technical team that treats security as a top priority. Employees sign an NDA, follow security policies and participate in role-specific internal security training.

Incident Response

We have established procedures for responding to security and privacy incidents related to our products and services. We publish a point of contact for security researchers.

Risk Management

We conduct regular risk assessments and internal evaluations of our information security management system, our infrastructure, and all internal processes.

Security Vulnerability Disclosure

If you believe you have found a security vulnerability in MakePlans, or have any other security concerns, please see information about bug bounty or contact us at hello@makeplans.com.