TOPdesk SaaS has an ISAE 3000 type II certificate, which is audited annually, covering the previous period from April to April. The certification report by the external auditor can be requested through your account manager (see Contact us).
ISAE 3000 has been chosen as the most applicable certification for our SaaS services. This international standard, comparable to SOC 2 – Type 2 audits in the US, can be used to check if the risk management systems regarding information security, availability, integrity, confidentiality, and privacy are adequate for the desired goal, and if the targets set by TOPdesk have been met.
A Type II ISAE 3000 certification always concerns the past, as the auditor tests whether the controls were sufficient during a certain time frame.
The ISAE 3000 certification also covers subcontractors. This means that TOPdesk verifies that the datacenters used have sufficient (data) security measures, including relevant audits, and certifications on the services provided (also see Who does what). Our auditor verifies that TOPdesk has requested and inspected the relevant certificates.
An ISAE 3000 certificate also tests information security. This means there is an overlap with ISO 27001. An ISO 27001 audit tests if the management system for information security is adequate and if certain standards are met. In this sense, ISAE 3000 type II has a broader coverage, as the audit also checks whether the control systems were sufficient to accomplish the desired goal.
ISAE 3402 certification is also often mentioned for SaaS services. However, this is a standard for outsourced financial processes. Because the processes in TOPdesk often have no direct link to the (annual) financial reports of your organization, this standard is less relevant for our customers than ISAE 3000.
We only allow secure connections to TOPdesk SaaS environments. HSTS preloading is used to ensure all common browsers force users to a secured connection. The strength of our SSL certificate (used to encrypt the connection) is evaluated on a regular basis and currently has an A+ score from Qualys SSL labs.
TOPdesk uses a Content Delivery Network (CDN) for worldwide fast availability of TOPdesk environments, (D)DOS protection, and to block known threats. An intrusion detection system* helps detect attacks against our software in an early stage and will inform our hosting team of any problems.
Additionally, you can use your own intrusion detection system and link this to the TOPdesk access logs. It's also easy to set up an IP restriction for your TOPdesk SaaS envrionment, so only your colleagues can access your TOPdesk environment.
Antivirus and malware definitions are updated daily. File scans during upload, and regular full storage scans, ensure your users can safely work with attachments.
Access to your customer data folder is only possible from your TOPdesk environment, and data is stored so that only the TOPdesk environment that created a file can access it. This dual layer of security ensures that data can never be accessed by unauthorized users.
TOPdesk will also ensure all relevant updates are installed in a timely fashion (see Server management and Always up to date).
Secure coding guidelines ensure our software is of high quality and safe to use. Our measures include:
An external auditor performs daily automated penetration tests against known threats and OWASP vulnerabilities. These tests are verified by a security expert at least every 3 months. You can also execute your own penetration test, but please inform us beforehand.
These efforts have led to an ISAE3000 type II audit report (see certification), which you can request to verify the security of our procedures and processes.
