Security

Introduction

Key to the provision of online fundraising and marketing services is the efficient processing of financial transactions, including credit and debit cards and direct debits and associated personal details. It goes without saying that the security, confidentiality and reliability of this information is paramount at all times.

This is a brief overview of the main security processes and systems we utilise to ensure that you can have 100% confidence that the data you entrust to our safekeeping is 100% secure at all times.

Processes and systems

Servers

• A Managed Server service ideal for critical online systems
• High specification, fault tolerant, multi-processor capable servers
• All servers hosted in specialist remote centres, located in IBM Business Continuity buildings, with 24 hour on site security access.
• Clean and continuous mains power, with building level UPS systems and dual generator backup
• Online automated disk-to-disk data backup

Staff and working procedures

• Pre-employment recruitment screening to industry PES level 3 standard
• Legally binding confidentiality and non-disclosure agreement as condition of employment
• Comprehensive Internet, Email and Data Usage policies rigorously monitored and adhered to
• USB ports and other physical data output devices (Diskettes, CD drives, etc) blocked using the NetSupport Protect product
• Laptop hard drives encrypted using the ‘BeCrypt’ product
• Access to personal, non-business email usage, eg Hotmail, Googlemail, etc blocked 

Data Management

• Sonic Firewall in place with regular vulnerability scans
• Two factor authentication mechanism used for remote access needing a certificate and a source IP to connect to the Sonic Firewall.
• All offsite backups encrypted using blowfish 448 encryption.
• The card payment gateway is fully accredited as a Level 1 compliant provider under the Payment Card Industry Data Security Standard (PCI DSS)
• Full accreditation with the relevant Data protection standards

Internet

• All data and communication links are encrypted by 256bit SSL encryption
• All client web server certificates issued by Thawte
• Client can set user access privileges without recourse to us, ie you manage who can access your data and when
• Detailed, secure audit maintained at all times of who is doing what
• Comprehensive virus, malware and adware checking at all stages

Summary

We recognise that security is top priority at all times and we continuously monitor and strive to keep on top of industry advancements. We also have to pass regular security audits undertaken by VOCA (formerly BACS) and by Royal Bank of Scotland – the most recent of these being in June 2009.  

We are confident that our security is as good as it can be. However, we welcome your comments, feedback and suggestions, especially if you have any special security requirements

To find out more simply contact us or complete the registration form.