Personal data, protected by design
Our customers trust our software with the personal data of their people. Here is how Maas Software Engineering handles that data: what we collect on their behalf, who can see it, how it is protected and when it is removed. Written for data protection officers and procurement reviewers.
How we protect it
Security is built into how we run our software every day. The controls below apply to every environment we host. Independent auditors check them, not just us.
Hosted in Microsoft Azure
Each customer has its own logically separated environment. Production is separated from test and development.
Encrypted in transit and at rest
TLS on every connection and Azure encryption at rest. The most sensitive fields get an extra RSA 4096-bit layer, with keys held in Azure Key Vault.
Role-based access
Least privilege. Basic, private (passport) and medical data each need a separate right.
Two-factor authentication
Available to every user. A password policy is enforced at account creation and at every reset.
Field-level audit trail
Every change to a sensitive record is logged: who changed what, and when.
Tested backups
We back up, and we test the restore. Continuity and recovery procedures are reviewed every year.
Tested and monitored
Independent penetration tests, secure development practices and Microsoft Defender for Cloud monitoring.
ISO/IEC 27001
Our information security management system is certified to ISO/IEC 27001.
Questions from your data protection officer?
We answer DPO questionnaires and security assessments as part of procurement. Ask for the latest completed questionnaire and start from there.
