At TOPdesk, we're serious about the security of your data. As security is never finished, we're constantly working to improve the security of our hosting services, software, and internal procedures. You can read more about our security efforts below, and on our Tech blog:
On the Contact us section of this page you can find more information about reporting security issues.
We only allow secure connections to TOPdesk SaaS environments. HSTS preloading is used to ensure all common browsers force users to a secured connection. The strength of our SSL certificate (used to encrypt the connection) is evaluated on a regular basis and currently has an A+ score from Qualys SSL labs.
TOPdesk uses a Content Delivery Network (CDN) for worldwide fast availability of TOPdesk environments, for (D)DOS protection, and to block known threats. A Security Information and Event Management (SIEM) system is used to detect attacks against our network in an early stage. These systems are monitored 24/7 by a Security Operations Center with certified security experts.
Additionally, you can use your own intrusion detection system and link this to the TOPdesk (access) logs. It's also easy to set up an IP restriction for your TOPdesk SaaS environment, so only your colleagues can access your TOPdesk environment.
Antivirus and malware definitions are updated daily. File scans during upload, and regular full storage scans, ensure your users can safely work with attachments.
Servers are hardened by only allowing predefined connections, setting all relevant security settings and monitoring these settings against a desired state. TOPdesk will also ensure all relevant updates are installed in a timely fashion (see Server management and Always up to date).
Management access is limited to a small group of TOPdesk SaaS administrators and is only possible using a personal account and via a multi-factor authentication gateway (see Access management). Separate servers are configured for management access, which are hardened and closely monitored.
Your data is stored separate from other customers' data. Customer specific files (like attachments) are stored in a folder which can only be accessed by your dedicated TOPdesk environment. Folder and file permissions ensure that only the TOPdesk environment that created a file can access it.
This design also ensures that malware can't spread within our SaaS network. Only your TOPdesk environment can access your files and doesn't have permissions to execute something, or to access files outside your folder, preventing viruses from spreading.
A similar design is used for databases; your TOPdesk environment can only connect to it's dedicated database, and database permissions ensure that no application but your TOPdesk environment is allowed to access the data. This dual layer of security ensures that data remains segregated from other customers, and can never be accessed by unauthorized users.
Secure coding guidelines ensure our software is of high quality and safe to use. Our measures include:
During development all software components and dependencies are scanned for known vulnerabilities. If no problems are found, the software is compiled and automatically tested. When all tests are successful, the software is deployed on a live environment which is scanned (black-box) for vulnerabilities on a daily basis. A daily automated penetration test verifies if common or previously found issues can be exploited. These tests include known threats and OWASP vulnerabilities.
The daily automated vulnerability scans and penetration tests are executed by an external auditor. To verify the scan results, improve future scans, and detect new issues specific to the TOPdesk software, a certified independent security expert performs a security test at least every 3 months. If the security test, penetration test, or vulnerability scan results in any actionable findings, TOPdesk will resolve these with the highest priority.
You can also execute your own penetration test or vulnerability scan, but please inform us beforehand.
These efforts have led to an SOC 2 audit report (see certification), which you can request to verify the security of our procedures and processes.
