Technical and organizational security measures (TOM)

Last update: 21.06.2018

I. Confidentiality

1. Physical access control of the Supplier
   1. wservices does not have physical access to servers (computers) which are located in a data center.
   2. The disks of all office computers, laptops and flash drives which contain Personal Data are encrypted.
2. Physical access control of Sub-processors
   1. physical entry control system with log
   2. documented distribution of keys to employees
   3. policies for accompanying and designating guests in the building
   4. data center staff present 24/7
   5. video monitoring at entrances and exits
   6. security door interlocking systems and server rooms
3. Electronic access control
   1. E-Mail-Account and SSH user passwords are not known to the Supplier.
   2. The Customer's password for the administration interface is determined by the Customer himself; the password must comply with predefined guidelines.
4. Internal access control
   1. The Supplier shall prevent unauthorized access by:
      1. applying security updates regularly
      2. by using state of the art technology
      3. a revision-proof, compulsory process for allocating authorization for supplier employees
   2. The Customer is responsible for transferred data/software with regard to security and updates.
5. Isolation control
   1. for the Supplier's internal administration systems
      1. Data shall be physically or logically isolated and saved separately from other data.
      2. Backups of data shall also be performed using a similar system of physical or logical isolation.
6. Pseudonymization
   1. The Customer is responsible for pseudonymization.

II. Integrity (Art. 32 Para. 1 Clause b GDPR)

1. Data transfer control
   1. All employees are trained in accordance with Art. 32 Para. 4 GDPR and are obliged to ensure that personal data is handled in accordance with data protection regulations.
   2. Deletion of data in accordance with data protection regulations after termination of the contract.
   3. Encrypted data transmission options are provided.
2. Data entry control
   1. For the Supplier's administration systems and for the web hosting services, data is entered or collected by the Customer.

III. Availability and Resilience (Art. 32 Para. 1 Clause b GDPR)

1. Availability control
   1. Backup and recovery concept with daily backups of all relevant data depending upon the services booked by the Customer.
   2. Professional employment of security programs (virus scanners, firewalls, encryption programs, spam filters)
   3. Employment of disk mirroring on all relevant servers
   4. Monitoring of all relevant servers
   5. Employment of an uninterruptible power supply system or emergency power supply system
2. Rapid recovery measures (Art. 32 Para. 1 Clause c GDPR)
   1. For all internal systems, there is a defined escalation chain which specifies who is to be informed in the event of an error in order to restore the system as quickly as possible.