07 – Hosting and data

Situm is provided as a Software as a Service, hosted in the Microsoft Azure cloud. As shown in the diagram below, Situm may receive secure communications (HTTPS) from:

  1. Situm Web Dashboard. 
  2. Apps that integrate Situm mobile SDKs (Android / iOS / Cordova).
  3. 3rd party software (via REST APIs).

Situm platform receives and computes those requests using Microsoft Azure cloud platform (West Europe region). Situm data (cartography, geolocations…) is also mostly stored in Microsoft Azure cloud (see our Master Subscription Agreement for more details).

On the other hand, Situm makes use of some 3rd party software itself. The most important services are:

  1. Google Maps. Base maps provider used by Situm Web Dashboard.
  2. Mapbox. More base maps provider used by Situm Web Dashboard.
  3. Froala. Rich Text plugin, used for entering Rich Text in POIs, geofences, etc.
  4. Google Analytics. For the aggregated analysis of the use of Situm Dashboard.
  5. Google Firebase. Crashlytics (register app events for debugging purposes), Remote Config (notify users when new app versions are available), Google Analytics for Firebase (aggregated analysis of the use of apps), and notifications in general.
  6. Tinybird. OLAP databased for fast analytics.
  7. Datadog. Logs & monitoring.

Security overview #

At Situm, we want to offer the maximum guarantees of compliance with security and data protection requirements. Security is an integral part of our products, processes and services that we are continuously reviewing to maintain the highest standards of compliance.

Security as a fundamental pillar #

Data security is a fundamental pillar when developing our products, processes and services. We approach the design of all functionalities and changes in our architecture with a mindset of:

  1. Compliance with GDPR guidelines.
  2. Privacy by design and by default.
  3. Data gobernance accountability.
  4. Continuous improvement.

That is why security at Situm is integrated into the day-to-day life of all workers and all improvements to our software, processes and services are always made with security in mind. Our cloud is designed to respond to a multitude of challenges in different industries with different security requirements. In order to meet them, we aim at meeting the highest standards across all industries.

Reliability #

Situm Platform is a central part of many business applications and end-customer oriented applications. We understand the importance of reliability in our platform and hence we have put in place a series of measures to ensure it.

SLA #

We aim to provide at least 99.9% of uptime and solve critical requests in a few hours at most. Please read our SLA in Exhibit B of our MSA for more details: https://situm.es/assets/docs/situm-masteragreement.pdf

Availability and Redundancy #

Situm Platform provides high-availability and redundancy by default. Situm services replicas run on multiple nodes with the ability to scale vertically and horizontally. 

In addition, to ensure maximum availability, we host our platform and data on Microsoft Azure. Microsoft Azure data centers are designed to provide high availability for the applications they host, and Situm follows Azure’s best practices in order to make the most of the capabilities provided by Azure.  

Avoiding data losses: redundant storage and backups #

Situm secures all the data in multiple ways to avoid losses.

  1. Redundant storage. All the data is stored in redundant systems by default.
  2. Incremental daily backup. Automatic incremental backups of all the data are generated daily.
  3. Complete weekly copy. In addition to incremental daily backups, a full weekly backup is generated to maximize recoverability.  

Backups are encrypted with RSA 4096 asymmetric keys. Backups are kept for 45 days (in case of database information) or 60 days (in case of files, such as images).

Business continuity and disaster recovery #

Ensuring the continuity of our service (and your business) is a key priority at Situm. These are the main elements that help us in minimizing the impact of any eventuality:

  • Continuous logging and monitoring. Situm Platform logs the interactions with its APIs and monitors the network traffic for early trouble detection (with automatic internal alerts).
  • Redundant backup storage. Backups are replicated in different Azure geographical regions within Europe in order to avoid a full data/service loss in the (very unlikely) event that a whole Microsoft Azure data center or geographical area fails.  
  • Restoration & integrity tests. We perform daily, weekly, and quarterly tests (with different level of granularity and detail) to ensure that the restoration procedures work as expected and that the backup data is recoverable.  

Product Security #

Password and API key protection with role-based data segmentation #

Situm Platform is protected from unwanted data access through password and/or APIKEY based authentication & authorization.

  1. Passwords must meet a minimum complexity (8 characters) and, in case the user forgets them, can be re-generated through email validation.
  2. APIKEYs can be generated in order to consume Situm APIs from 3rd party systems, such as web apps or your Situm-based mobile apps.

Situm users can be segmented into different roles, each role having different data accesses. Similarly, API keys can have different permission levels: positioning-only (allows mobile apps to perform indoor/outdoor positioning), read-only, and read & write.

Encryption and key management #

Data encryption is performed at different levels to ensure a complete protection:

  1. Encryption in transit. We use “Transport Layer Security (TLS) 1.2 or higher” protocol for all communications that go through public networks such as the Internet. 
  2. Encryption at rest. Microsoft Azure provides “Encryption at rest” in all the storage services that we use.  In addition,  Azure manages the encryption keys automatically, thus helping to avoid potential key leaks.

Password policy #

Situm Platform users’ passwords need to have a minimum complexity of 8 alphanumeric characters. We store these passwords properly hashed and encrypted, so it is not possible to recover them. Nevertheless, passwords can be regenerated by email at user request  (automatically, without our intervention).

Client isolation #

Different users/clients share the same physical infrastructure, but Situm provides logical isolation between the data of different users/clients. This isolation ensures that actions performed by a certain client will not compromise the data of other clients.

Vulnerability / incident management #

Situm has established an internal incident and vulnerability management policy following the GDPR guidelines. This includes, among other measures, early evaluation of any data breach and communication to affected customers (or to the data protection agency) depending on the severity of the incidents.

Data operations #

Data processed & stored #

Please read our GDPR section for a description and list of the data that Situm processes and stores. 

Accessing the client data for maintenance #

At Situm, only a few employees have access to client data for maintenance, based on an appropriate segmentation of roles and responsibilities within the company.  All employees are required to abide by a corporate password policy that includes, among others, measurements such as periodic key renewals.

Access to client data is continuously monitored. Non authorized accesses are treated as data breaches. Physical access to data centers is protected by Microsoft security policies and measurements.

Accessing the client data for customer support #

Our Customer Success team (customer support) will only access client data if it is strictly necessary to solve a ticket or request raised by the client.  

Data destruction #

Situm follows GDPR guidelines for data destruction. More info in our MSA.

Privacy and GDPR #

Situm is GDPR compliant because when you use Situm, you trust us with your data. This is why we have implemented all the security and privacy measures that allow us to protect your data and ensure your rights. We take our obligation to safeguard users’ personal information very seriously and are committed to protecting the privacy and security of our users, while being transparent about our data practices.

What data does Situm store? #

The following information is a summary of the data that Situm could process:  

  1. Mobile device information. This information includes: geolocation, sensor readings (e.g. WiFi readings), device information (e.g. OS), app information (e.g. package name, SDK version), etc. All the device information is associated with an unique pseudo-anonymous identifier of the device (not of the user) that ensures their privacy.
  2. Situm Dashboard users information. We also store some information of the users that are registered on the Situm Dashboard (e.g. the administrator account), such as: email address and contact information provided by the user, OS, cookies, etc.
  3. Cartography information of those buildings that are uploaded to the Situm Dashboard: floorplans, points of interest, etc. This information is not considered as personal data of the user.
  4. Logging data of user interactions with Situm Services, such as device IP, accessed URL, etc.
  5. In case the user activates the “Workforce Tracking” module (Situm MRM), other additional information may be processed, such as: historical relationship of devices (and their IDs) to which each user has been associated with, alarms generated by the users, etc.

The most sensitive data that Situm stores is the geolocation data (indoor and/or outdoor) of each device that runs Situm SDK. To ensure maximum privacy protection, Situm does not associate this information with the user by default, but to a pseudo-anonymous identifier of the device (not of the user). 

For a complete list of the data, see Annex I of Situm Master Subscription Agreement.

Where do we store the data? #

Situm trusts Microsoft Azure as its cloud provider. Azure has stated that is compliant with the most relevant security and privacy policies, as well as the GDPR provisions. 

By default, Situm stores all the data in Europe (West Europe region). We are also aware that you may prefer to store your data in other geographies, and we offer this option too. 

Just send us an email to sales@situm.com with your case and we will help you in this regard.

Who else will have access to the data? #

Situm trusts several data subprocessors to ensure the maximum quality of the service, such as Microsoft Azure or Google Maps. Our Annex II of Situm Master Subscription Agreement (MSA) contains a full list of subprocessors.

What provisions has Situm put in place to ensure GDPR compliance? #

We’ve been working hard to ensure that we’re in compliance with the GDPR. The following is a non-exhaustive list of the main provisions:

  1. Situm has appointed a Data Protection Offices that foresees the GDPR compliance of the organization. You can reach to the Situm DPO by writing an email at dpo@situm.com.
  2. Situm has adequately put in place a “Data Processing Addendum” that regulates the GDPR provisions for the personal data treatment. It is available for review in our Situm Master Subscription Agreeent (MSA) (Section 8, Exhibit B and Annexes I y II).
  3. Situm supervises GDPR compliance by performing the recommended GDPR internal procedures, such as the Privacy Impact Assessment, applying UE standard contractual clauses, etc.
  4. Situm has put in place the security measures and policies required to adequately protect your data, including privacy by design, backup and disaster recovery policy, access control protection, password policy, device inventory policy, data encryption policy, data breach action protocol, security and GDPR staff training, etc.

We will continue to review our security measures, as we always do, to warrant the compliance of the GDPR provisions and the European Data Protection Board recommendations.

Can I use Situm Services if I have customers in the UE? #

Yes! The main purpose of the GDPR is to protect and grants data subjects specific rights to their personal data. Understanding these rights and how to comply with them as a Data Controller is essential to comply with the GDPR provisions. Situm will be acting as a Data Processor for your customer’s data and will provide ways to comply with all of your data subject’s rights under the GDPR obligations of a data processor.  As Data Controller, you will need to inform to the UE users which data are you collecting that may be considered personal, including the data that Situm Services process from the users, and determinate how you will use the users consent or other lawful basis when Situm will be processing personal data as your Data Processor. You can check our “Data Processing Agreement” at the Exhibit D of the Situm MSA.

Can I use Situm Services if my customers are outside the UE?  #

Of course! We warrant the compliance of the GDPR by default because we are established at UE, which has one of the highest regulations for security of personal data. If your customers are outside the UE, you will also have these high standard security measures required by the GDPR. In any case, you can also contact our team (dpo@situm.com) for more information on your needs of personal data protection.

Where can I learn more about this topic? #

Please check:

  1. Section 8, Exhibit B and Annexes I y II of Situm Master Subscription Agreement (MSA)
  2. Our Privacy Policy.

Or write us an email to dpo@situm.com.

Subscribe to our newsletter

BASIC INFORMATION ON DATA PROTECTION

Data controller: SITUM TECHNOLOGIES, S.L.
Contact: Data controller: situm@situm.es
Responsible for protection: dpo@situm.es
Purpose and legal basis: To manage the sending of SITUM newsletters only with consent.
Legitimation: Express consent of the interested party.
Recipients: The data will not be passed on to third parties with the exception of legal obligations.
Retention period: As long as the interested party remains subscribed to the newsletter (a link to unsubscribe will be available in each newsletter sent by Situm).
Rights: The interested party may at any time revoke their consent, as well as exercise their rights of opposition, access, conservation, rectification, limitation, deletion of data and not be subject to a decision based only on automated data processing, by writing to SITUM at the addresses indicated.
Additional Information: You can consult additional and detailed information on Data Protection in our privacy policy.

Please, download your copy here

Thank you for downloading our whitepaper. Please do not hesitate to contact us if you would like to know more about how our solutions can help your business. Download whitepaper


Close window