Safety measures

UDITIS (or “we,” as used hereafter) is committed to being a trusted partner for our customers. Security is therefore a fundamental priority for us.

We handle the data security and availability aspects related to the use of the online services offered by our company in IaaS and PaaS modes, as well as those related to applications developed and hosted in SaaS mode.

1. Legal compliance

As a provider of services and applications to our clients, we act as a data processor under the Data Protection Act (DPA). We are committed to complying with our obligations under this law and, in the interest of transparency, explain in this document the organizational and technical security measures we have implemented.

2. Development, hosting, and outsourcing

We develop applications using our own developers or subcontractors in Switzerland. Unless the client specifically requests and specifies otherwise, our online services and solutions—as well as the personal data they contain—are hosted in data centers operated by ISO 27001-certified providers, all of which are located in Switzerland or Europe.

3. Data security

We encrypt data in transit using the TLS protocol or VPN tunnels. User credentials are encrypted using appropriate technologies that are constantly updated, as is sensitive data, to the extent permitted by technical capabilities and functional requirements.

4. Privacy

With rare exceptions for certain shared solutions, data is strictly segregated into separate databases and folders for each client to ensure that each client’s information is handled confidentially.

The architecture of our applications ensures data isolation through dedicated databases and specific security perimeters. No information is transmitted or disclosed to third parties without the client’s explicit consent. Our employees are contractually bound to professional confidentiality.

5. Availability

All components of our infrastructure are resilient to outages thanks to equipment redundancy and virtualization. Services are monitored 24 hours a day, 365 days a year by our support team. Alerts are addressed and issues resolved in accordance with the SLAs specified in the relevant contracts.

Our incident recovery procedures enable rapid restoration of services in the event of a major incident.

6. Access control

Customer access to applications is protected by a combination of a username and password. Two-factor authentication (2FA) is a feature that is gradually being rolled out across our services and various applications.

The applications developed by our teams allow you to precisely define which data is accessible to each user and which is not. It is the customer’s responsibility to define its password management policy, ensure its proper implementation, and properly configure permissions for its own users.

With regard to employee access to our various systems, access is systematically protected by two-factor authentication and by passwords that meet minimum complexity requirements. The principle of least privilege is also applied to restrict access.

7. Sauvegardes

To mitigate any risk of data loss, our applications’ databases are fully backed up every day, and the restoration procedure is tested regularly.

Backups are stored at separate locations and are retained in accordance with our retention policy.

8. System updates

Our systems are regularly updated in accordance with best practices and vendor recommendations. Generally speaking, the redundancy of our systems and our procedures allow us to perform maintenance without interrupting service. Advance notifications are sent via email to our customers in cases where a system outage cannot be avoided.

9. Internal organization

We have established security policies and procedures, which are communicated to all staff members. Employees regularly receive training on cybersecurity and the protection of personal data.

The position of IT Security Manager reports directly to senior management.

10. Responsabilities

In accordance with legal data protection requirements, we maintain a record of processing activities and a security incident log.

The principles of data protection by design and by default are applied to all new developments. Privacy impact assessments are also conducted when the situation warrants it.