Many of our customers need to understand more about how we handle your data. This high-level synopsis covers the typical questions posed to our operational teams on a daily basis. This article is not intended to answer all low-level queries and we encourage you to continue to raise detailed queries with our operational teams by raising a request.
Is Encodian ISO 27001 certified?
Yes, we have achieved ISO 27001 certification, please refer to the attached certificate.
Do Encodian store your data?
Yes. Encodian Sign is a persistent digital-signature service and therefore stores customer data required to provide the service.
Depending on how the service is used, this may include:
- documents and signed documents;
- envelopes and transaction information;
- recipient information;
- audit and signing-event information;
- document and transaction metadata; and
- customer-specific service configuration.
Customer data is retained while the associated subscription remains active.
If a subscription expires or is disabled, the associated production data is retained for 90 days to allow the account to be reactivated without loss of existing documents, envelopes, audit information or related service data.
If the subscription is not reactivated, the associated production data is deleted after the 90-day retention period, unless a longer retention period is required by law, contract, legal hold or another applicable obligation.
Customers may also request earlier deletion. Where the request can be appropriately authenticated and there is no legal, regulatory, contractual or preservation requirement preventing deletion, the data will be deleted before the standard 90-day period has elapsed.
You can learn more in our Data Processing Agreement and Customer Data Retention, Backup and Recovery Policy.
Does Encodian Sign back up customer data?
Yes. Encodian Sign maintains backups for operational and disaster recovery purposes. Backups are not used as a long-term archive of customer information.
Our recovery controls include point-in-time recovery for recent operational incidents and independent backup copies retained for approximately 90 days, depending on the underlying data service.
When production customer data is deleted, existing backup recovery points may continue to contain historical copies until those recovery points reach the end of their normal retention period.
No new backups will contain the deleted production data, and historical backup copies are not retained beyond their normal lifecycle solely for archival purposes.
Can Encodian staff access my data?
Encodian staff do not routinely access customer documents or customer data as part of normal service operation.
Access to production systems is restricted and controlled using role-based access and operational security controls.
If you raise a support request, our operational teams may ask you, where necessary, to provide sample documents, envelope information or related configuration details to assist with investigation.
Where access to production customer information is required to investigate an issue, access is restricted to authorised personnel and undertaken in accordance with Encodian's security and operational procedures.
Is your data encrypted?
Yes, your data is encrypted both in transit and at rest. Encodian Sign uses Microsoft Azure platform security capabilities to protect stored customer information, including encryption of Azure Storage and Azure SQL Database data at rest.
Communications with Encodian Sign are protected using HTTPS and modern TLS encryption.
How and where is your data processed?
Encodian Sign is hosted using Microsoft Azure services. Customer data is processed and stored in the region selected upon subscription creation. We provide processing in the following regions:
Australia
Canada
Germany
Switzerland
United Kingdom
United States
Each supported service region maintains its own production storage, database and associated recovery data.
Where regional data-residency requirements apply, customer data and associated backups remain within the assigned Azure region. Cross-region replication is not used where doing so would cause customer data to leave the permitted region.
This means documents, envelope information, recipient details, audit information and associated backup data remain within the relevant regional service boundary.
Encodian uses solely Microsoft Azure 'PaaS' services, therefore your data will never leave a Microsoft data centre nor will it be processed by an un-managed virtual machine. Utilizing Microsoft Azure 'PaaS' services allows Encodian to make full use of all native Microsoft Azure security features.
How does Encodian ensure data privacy and segregation?
Data privacy, security and trust are core priorities for Encodian Sign.
Encodian Sign uses multiple layers of Microsoft Azure security capabilities to protect customer data, including:
- encryption in transit and at rest;
- regional separation of customer data;
- role-based access controls;
- restricted administrative access;
- resilient storage and database services;
- backup and recovery controls; and
- security monitoring and auditing.
Customer production data and associated recovery data are separated by Azure region, and cross-region replication is not used where this would conflict with applicable data-residency requirements.
Will you share your architecture diagram and details IP / Port config?
We do not share detailed information regarding the architecture and hosting of our API / Services. If you have an explicit query please submit a request to our operational teams who will be able to help.
How is Artificial Intelligence (AI) technology used within Encodian products?
We do not currently use Artificial Intelligence within Encodian Sign.
0 Comments