Personal data, protected by design
To get a research party to sea, an institute collects passports, medical declarations, next of kin and bank details. MFP collects this data once, shows it only to the people who need it, and removes it when it is no longer needed. This page says how. It is written for data protection officers and procurement reviewers.
Collected once, seen only by those who need it
Passports, medical declarations and next-of-kin details for the people who sail. Here is what we do with them.
How we protect it
Security is built into how MFP runs every day. The controls below apply to every MFP environment. Independent auditors check them, not just us.
Hosted in Microsoft Azure
Each customer has its own logically separated environment. Production is separated from test and development.
Encrypted in transit and at rest
TLS on every connection and Azure encryption at rest. The most sensitive fields get an extra RSA 4096-bit layer, with keys held in Azure Key Vault.
Role-based access
Least privilege. Basic, private (passport) and medical data each need a separate right.
Two-factor authentication
Available to every user. A password policy is enforced at account creation and at every reset.
Field-level audit trail
Every change to a sensitive record is logged: who changed what, and when.
Tested backups
We back up, and we test the restore. Continuity and recovery procedures are reviewed every year.
Tested and monitored
Independent penetration tests, secure development practices and Microsoft Defender for Cloud monitoring.
ISO/IEC 27001
Our information security management system is certified to ISO/IEC 27001.
Questions from your data protection officer?
We answer DPO questionnaires and security assessments as part of procurement. Ask for the latest completed questionnaire and start from there.
