Data Controller
- Decide which data is stored
- Decide who has access to the data
- Data processing agreement with TOPdesk
Data Processor
- Keep TOPdesk environments running
- Ensure the safety of data (stored and in transit)
- Data processing agreement with datacenter
Sub processor
- Keep the servers running
- Ensure internet connectivity
- Guarantee physical security of equipment
Certification
TOPdesk SaaS has an SOC 2 certification, which is audited annually, covering the previous period from April 1 to March 31. The certification report by the external auditor can be requested through your customer success manager (see Contact us).
SOC 2 has been chosen as the most applicable basis for reporting on our SaaS services. This international auditing standard is used to check if the risk management systems regarding security, availability, confidentiality and privacy are adequate for the desired goal, and verifies that the targets set by TOPdesk have been met in the previous period.
The SOC 2 certification also covers subcontractors. This means that TOPdesk verifies that the data centers used have sufficient (data) security measures, including relevant audits, and certifications on the services provided (also see Hosting locations and Who does what). Our auditor verifies that TOPdesk has requested and inspected the relevant certificates.
A SOC 2 certification always concerns the past, as the auditor tests whether the controls were sufficient during the time since the last audit. TOPdesk is committed to continue improving our security and procedures. If necessary, a bridge letter can be created to show the improvements we've made since the last audit.
Additionally, our SOC2 report includes a framework mapping, showing how controls of the ISAE 3000 SOC2 audit report map to ISO 27001.
Hosting sustainability
We strive to make our products as efficient and sustainable as possible. A large part of the environmental impact of our products comes from hosting our customers’ SaaS environments. All Microsoft Azure hosting locations operate carbon neutral and have been carbon neutral since 2012.
Server management
Using TOPdesk SaaS, you can rest assured your data is hosted on up-to-date hardware, running the latest security updates, and with all relevant server hardening methods. The TOPdesk SaaS network is completely separated from the TOPdesk corporate network, and all TOPdesk SaaS servers are deployed automatically and registered in our CMDB. This has numerous advantages:
Security
At TOPdesk, we take your data security seriously. Recognizing that security is an ongoing process, we continually strive to improve the security of our hosting services, software and internal procedures. You can read more about our security efforts below, and on our Tech blog:
On the Contact us section of this page you can find more information about reporting security issues.
Secure hosting
We only allow secure connections to TOPdesk SaaS environments. HSTS preloading is used to ensure all common browsers force users to a secured connection. The strength of our SSL certificate (used to encrypt the connection) is evaluated on a regular basis and currently has an A+ score from Qualys SSL labs.
TOPdesk uses a Content Delivery Network (CDN) for worldwide fast availability of TOPdesk environments, for (D)DOS protection and to block known threats. A Security Information and Event Management (SIEM) system is used to detect attacks against our network in an early stage. These systems are monitored 24/7 by a Security Operations Center with certified security experts.
Click the image for details
Additionally, you can use your own intrusion detection system and link this to the TOPdesk (access) logs. It's also easy to set up an IP restriction for your TOPdesk SaaS environment, so only your colleagues have access your TOPdesk environment.
Antivirus and malware definitions are updated daily. File scans during upload, and regular full storage scans, ensure your users can safely work with attachments.
Servers are hardened by only allowing predefined connections, setting all relevant security settings and monitoring these settings against a desired state. TOPdesk will also ensure all relevant updates are installed in a timely fashion (see Server management and Always up to date).
Management access is limited to a small group of TOPdesk SaaS administrators and is only possible using a personal account and via a multi-factor authentication (MFA) gateway (see Access management). Separate servers are configured for management access, which are hardened and closely monitored.
Data separation
Your data is stored separate from other customers' data. Customer specific files (like attachments) are stored in a folder which can only be accessed by your dedicated TOPdesk environment. Folder and file permissions ensure that only the TOPdesk environment that created a file can access it.
This design also ensures that malware can't spread within our SaaS network. Only your TOPdesk environment can access your files and doesn't have permissions to execute something, or to access files outside your folder, preventing viruses from spreading.
A similar design is used for the database management; your TOPdesk environment can only connect to it's dedicated database, and database permissions ensure that no application but your TOPdesk environment is allowed to access the data. This dual layer of security ensures that data remains segregated from other customers, and can never be accessed by unauthorized users.
Secure software development
Secure coding guidelines ensure our software is of high quality and safe to use. Our measures include:
- An extensive internal 'Definition of Done' which defines minimum standards for all software that is developed. These standards include topics like; accessibility, privacy, security, error handling, API usage, and much more.
- Using pair programming and code reviews to ensure adherence to our standards and code quality.
- Following secure coding guidelines and continuously testing on topics mentioned in the OWASP list.
- Using standard frameworks and methods to prevent vulnerabilities resulting from programming errors.
- Employing security-specialized developers who initiate knowledge sharing and peer reviews at our Development department.
- Actively keeping track of security issues with external methods used by TOPdesk. This way, we can take follow-up action if such an issue is found.
- Combining automated and manual tests during development and delivery phases.
- Getting external parties to evaluate all our versions before they go live on your production environments.
Penetration tests
During development all software components and dependencies are scanned for known vulnerabilities. If no problems are found, the software is compiled and automatically tested. When all tests are successful, the software is deployed on a live environment which is scanned (black-box) for vulnerabilities on a daily basis. A daily automated penetration test verifies if common or previously found issues can be exploited. These tests include known threats and OWASP vulnerabilities.
The daily automated vulnerability scans and penetration tests are executed by an external auditor. To verify the scan results, improve future scans, and detect new issues specific to the TOPdesk software, a certified independent security expert performs a security test at least every 3 months. If the security test, penetration test, or vulnerability scan results in any actionable findings, TOPdesk will resolve these with the highest priority.
You can also execute your own penetration test or vulnerability scan, but please inform us beforehand.
These efforts have led to an SOC 2 audit report (see certification), which you can request to verify the security of our procedures and processes.
Monitoring and incident response
TOPdesk has a 24/7 monitoring system on all TOPdesk SaaS environments and servers. The monitoring system verifies health metrics for every TOPdesk environment, like the (internal and external) availability, database connection and search index availability. Servers are also monitored on relevant metrics e.g. availability, CPU usage, memory usage and available disk space. To ensure our back-up system works as expected, we also monitor the last back-up restore test for database servers.
Should the monitoring system detect a problem, TOPdesk operators are immediately notified. During the night, a 24/7 stand-by shift ensures issues are quickly resolved. Issues affecting multiple TOPdesk environments are published on our status page and via My TOPdesk. You can also verify the monitoring results for your environment(s) on our portal, and (if desired) immediately schedule follow-up actions like a restart of your TOPdesk environment, or submit a ticket for our Support team.
Access for TOPdesk
TOPdesk employees will only access your TOPdesk SaaS environment when you have requested them to do so, for instance when you’ve asked our Support team for help.
All TOPdesk Support staff that might be granted access to your environment will have:
- a certificate of conduct
- a confidentiality agreement in their contract
- completed an extensive training program regarding the TOPdesk products, and hosting related topics such as handling confidential data and security awareness.
You can even determine whether TOPdesk employees can access your TOPdesk environment and limit this to your geographical region. This way you can e.g. limit or grant access to employees of a specific TOPdesk branch. You can configure this via Functional settings > Login settings > General in TOPdesk.
TOPdesk won't store any passwords for your environment, TOPdesk employees will only access your environment using a personal account from a secure TOPdesk authentication server.
Encryption
Encryption of stored data protects against data theft by someone with direct access to the disks on which the data is stored. TOPdesk has covered this risk in several ways.
The following steps have been taken to prevent theft of data:
- All our Azure hosting locations only use encrypted disks, for customer files, database back-ups, and TOPdesk databases. TOPdesk will continue to expand the available encryption options.
- Additional database encryption has been enabled from the beginning by default on all our hosting locations.
- TOPdesk and its hosting providers will ensure that all disks that have contained unencrypted customer data will be overwritten using DBAN before reuse, or the disk will be destroyed to make future use impossible.
- TOPdesk only uses well-protected data centers to host customer data. 24/7 security guards are present in the data centers and only previously announced persons with a valid ID are allowed in. There is continuous camera surveillance and all server racks have their own lock. This makes it impossible for unauthorized users to acquire the servers or the data stored thereon.
- Data is distributed over multiple disk drives. This ensures that an error on a disk does not cause loss of data, but also ensures that a stolen disk contains only fragments of files and hardly any readable data.
- TOPdesk has a monitoring system that verifies the available disk space on servers. If disks disappear unexpectedly, this monitoring system reports the change to TOPdesk operators who can contact the data center to check for anomalies.
- TOPdesk has data processing agreements with all used data centers. Data center operators are not allowed to handle customer data, and control procedures are in place. The effectiveness of these procedures is regularly audited, and TOPdesk reviews the audit results.
Contact us
If you have any questions about our SaaS hosting, don’t hesitate to contact TOPdesk Support for more information.
Responsible disclosure
We appreciate customers and security researchers reporting vulnerabilities in our software and infrastructure to us.
If you plan to execute a test on our product or SaaS infrastructure, please contact our Support department and ask for the collaboration agreement for penetration tests, that we have in place for this purpose. It provides guidelines on how to responsibly test our services and work together with us, which for instance prevents our security team from interfering with your tests when detected by our monitoring.
Read more about how to report findings on our Coordinated Vulnerability Disclosure page.
If you have any questions about our SaaS hosting, don’t hesitate to contact TOPdesk Support for more information.
