Platform security

Tygron observes due care with regard to your privacy and the security of your data. Our policy is based on the General Data Protection Regulation (GDPR) and we have taken any possible technical and organisational measures to protect (personal) data. Our starting points are:

• The license is applied by the user to work in a private domain protected by a password. This domain is managed by the user who determines who has access and to which project (the domain manager).
  • It is possible to implement two-factor authentication for your domain.
  • Domain Admins can force a minimum number of characters in new passwords
  • User passwords are stored via hashes and salting. This prevents the original passwords from being retrieved if they end up with persons that should not have access to them.
  • A username can be deleted by the domain manager and by Tygron (at request).
  • Tygron observes strict confidentially with regard to handling data. If a user wants Tygron to look into projects, for example to provide support, then Tygron’s support department cannot gain access to the project until the user has requested Tygron’s assistance.
  • Tygron employees who have access to the source code in view of their position and/or to project data, have entered into an additional confidentiality contract which is also valid after termination of employment.
  • Within the project, it will be visible when a user and which user has worked on what version. Projects can be removed by the user or (at request) by Tygron.
  • The data (projects) are saved and edited in the server application. The customer retains the title to such data at all times. The customer can retrieve/delete the data and assign rights via the Client Application.
  • Upon termination of the license agreement, the associated personal details and projects will be deleted; backups will be deleted after maximally two years.

• The personal data entered by a user under domain management are limited to the data required to execute the license agreement: the ability to provide support and the ability to inform about the maintenance and upgrades to the Platform. This includes the name and email address (needed to be able to obtain a password).
  • The telephone number is optional.
  • Users can indicate whether they do not want to receive emails about maintenance and upgrades.
  • These data are visible to the user under ‘my account’ in the Platform.
• The Tygron Platform only loads open data for projects by default. Although possible, it is not necessary for the user to add data to projects in advance. Data added by a user to projects and the domain are sent encrypted and stored securely.
  • The owner of the data (i.e. not Tygron) is responsible for ensuring that the use of such data is lawful.

• Tygron is only a data processor with regard to data in projects and cannot and will not use them for its own purposes. Consequently, processing only takes place on the basis of the license agreement.
  • We do not engage subprocessors by default. Should this ever be an item, then this will only take place with written permission.
  • Personal data are not shared with other processors without permission.

• A log is kept in which is visible when projects are active. This is necessary to see if a user stays within the agreed license limits.
  • Statistics are kept on how users use the application. These logs are immediately anonymous and are only for improving the software and support purposes.
  • Automatic crash logs can sometimes also contain personal data, these are only used to improve the software and then deleted.

• The Tygron Platform runs in the data center of Dataplace in Utrecht, the Netherlands. This ultramodern Tier III data center, located well above sea level, is in line with the further professionalization of the Tygron Platform in terms of security of supply, stability, safety and sustainability. We use an encrypted SSL connection (see below for details).

• The software is offered as SaaS. This means that the software is and continues to be Tygron’s property and that access as well as support and maintenance can be obtained through a license. The Tygron Platform consists of a Client and Server Application.

For technical details on how Tygron Platforms security is organised, please contact info@tygron.com. Some of our starting points are:

• Tygron always uses the latest and most secure industry standards (for SLL encryption, the latest TLS versions, hashes, salting, patches etc).
• Brute-force intrusions are automatically recognized and blocked.
• Daily, we run thousands of tests that do not only check our software but often also the connections to external systems.
• We regularly run penetration and vulnerability tests.
• We hire independent security specialists to perform pen tests on an regular basis.
• Both client and server contain various security mechanisms to prevent reverse engineering, manipulation or hacking.
• We have a firewall that blocks everything except specific IP addresses. The firewall also (temporarily) blocks suspicious behavior.
• Our server is built with our own hardware and runs in the Netherlands. The machines are locked in a datacenter where only authorized staff have physical access.
  • The servers run Ubuntu Linux, one of the most secure operating systems and standard for many web servers.
  • The datacenter has firewalls that can repel any attacks.
  • Servers are only accessible for qualified employees and only validated software is installed.
• We work by a secure coding policy.

In December 2021, a major security vulnerability was detected in Log4J that is used by many Java applications. Tygron uses Java but has always preferred to use its own logging system and is therefore NOT affected. We have also verified that none of the underlying libraries are using Log4J. We will continue to actively monitor this and other vulnerabilities.

Back up and restore strategy

• Every week a backup of the customer data is made on the production server of Tygron. This backup is made to an external server at another location in the Netherlands.
• Version management is made possible in our software to enable the recovery of a project in case of customer-specific problems.
• The user can save multiple versions of the same project to easily revert to a previous version in case of problems.
• In the event of calamities such as a disc crash, the customer data will be restored using the external backup, whereby data is only lost up to a maximum of a week.
• Back-ups of projects are retained for a maximum of 2 years and can be removed by Tygron at request. Data in the backups can also be given access to at request. Early removal of projects and access to data involve costs that are proportional to the hours to be spent for this purpose.

Organisational measures

• Data leaks are reported to Tygron’s management and documented by the COO. Data leaks are reported to the parties concerned in accordance with legislation. The COO is responsible within Tygron for taking actions in accordance with the GDPR.
• Before the date when the GDPR became into force, the preparatory steps as published on the website of the Dutch Data Protection Authority were examined. The privacy policy is discussed regularly within Tygron’s management and the team.

Data processing agreements

Tygron’s existing processing agreements have been verified and comply with the GDPR:

• The Freshdesk application is used for our support helpdesk.
• Freshdesk has its own privacy notice in accordance with the GDPR:

Freshworks

Tygron does not store the data entered in Freshdesk elsewhere and does not use it outside the application either.