Q: Where will our information reside? What is the geographic location of data center facilities? Which Cloud provider do you use and in which regions are the data centers located?
A: AskCody comes as a Software as a Service is built on Microsoft Azure and hosted in the Microsoft Azure cloud. To get a full list of compliance offering and to find audit information, go to the related certification on https://www.microsoft.com/en-us/trustcenter/compliance/complianceofferings
In Europe, AskCody utilizes the North Europe (Primary) and West Europe (Secondary) Azure regions. (Please see infrastructure document for details - https://www.goaskcody.com/askcody-on-azure.) The service is fully managed by us. Maintenance and updates are included in your subscription. In North America, we utilize East US (Primary) and West US (Secondary). Learn more about regions here - http://azuredatacentermap.azurewebsites.net/
We benefit from Microsoft’s unmatched scale and experience running trusted enterprise cloud services around the globe and why AskCody is built on Microsoft Azure. We leverage Microsoft’s deep investments in technology, operational processes, and expertise to provide a trusted platform for the AskCody solution. With Microsoft as our supplier of cloud services, we can take advantage of the Azure cloud more quickly while reducing security and compliance costs and minimizing risk to your organization.
We understand that to realize the benefits of cloud computing you as a company must be willing to trust your cloud provider with your data. When you invest in a cloud service, you must be able to trust that your data is safe, that data privacy is protected, and that you own and control your data in all its uses. AskCody is divided into a European and North American setup, due to data regulations. AskCody fully supports EU Model Clauses
All secondary data centers (West Europe and West US) works as a storage and geographically redundant backup.
Q: What is the process for providing clients their data at the end of service?
A: AskCody comes as a generic Software as a Service with built-in ability to extract relevant content and usage data in CSV format. The customer can’t require a custom specification for data export or extraction about system data. When a service period or subscription is ended, it is the Customers responsibility to extract relevant data. All data will be stored in 90 days in the Online Management Portal and an extra 90 days in backup data.
Q: Is your data center (and all backup locations) within the United States and/or within Europe accordingly to Customers Locations? Will all data remain within the U.S. or within Europe?
A: In Europe, we utilize the North Europe (Primary) and West Europe (Secondary) Azure regions. (Please see infrastructure document for details - https://www.goaskcody.com/askcody-on-azure.) The service is fully managed by us. Maintenance and updates are included in your subscription. In North America, we utilize East US (Primary) and West US (Secondary). Learn more about regions here - http://azuredatacentermap.azurewebsites.net/
Customer Data will never leave the Data Region on which the Customer Data is placed based on the location of the Customer, meaning the Customers in Europe will only be using Data Centers in Europe, and Customers in North America will only be using Data Centers in North America.
Q: What kind of Backup is provided? How often do you back up customer data?
A: Backup data is stored in 90 days in instances of 90 one day instances, 12 one week instances and 3 one month instances. Backup data will be destroyed after 90 days.
When a subscription is due, AskCody is no longer liable for providing backup of customer data. Customer Data will be available on the backup to the maximum of 3 months (90 days). All backup data is encrypted using TLS+1.2.
Q: Is logging a part of the AskCody platform? What tool of logging do you use? How is personal data pseudonymized and encrypted?
A: AskCody uses Application Insights for logging. All log data is stored on Amazon S3 and Rackspace in Dublin (AWS EU-West Ireland and XXXXX). All Log data is encrypted using TLS+1.2. AskCody stores log data for two years. For logging of personal data, both hashing and encryption are used meaning no personal data is personally identifiable
Q: What information is the cloud service logging (e.g. what security-related event types are logged and monitored)?
A: AskCody is logging operations that have a security impact (e.g., changes to security settings, such as ACL, roles, successful login, unsuccessful logon, logging, authentication, encryption, key handling). The logs are stored and available to authorized persons at least for two years.
Q: When subscriptions end, how is data destroyed? How do you ensure all of our data is erased at the end of the service?
A: It is AskCody’s responsibility to permanently destroy the Customer Data upon Customer’s request, with special emphasis on destroying all data in scope in all locations, and provide a written certification of the destruction. AskCody shall at its own discretion determine data destruction schedules but shall wherever possible perform such destruction in accordance with Customers' requested timetable. Supplier shall have the obligation to wipe persistent media used for storing Customers Data or secure deletion of Customers Data with related techniques before it is released into re-use.
Due to AskCody being built as a generic SaaS solution on Azure, AskCody doesn’t have physical access to wipe and destroy media used for Customer data on Azure.
For customer-specific data, we will manually remove all identifying calendar data associated with your account from our database. Derivate anonymized data (i.e. "Total events booked on a platform this month") will not be removed, as it cannot be linked back to source data. User accounts associated with your organization may also be removed on request.
When subscriptions end, Customer Data will be available on the backup to the maximum of 3 months (90 days) after which time the data will be completely unobtainable. All backup data is encrypted using TLS+1.2.