Your data and information is secure with TimeTonic

The security and confidentiality of your data is a priority for us, which is why we strive to implement the most stringent security technologies and standards to provide you with a reliable environment so that you can use TimeTonic with complete confidence.

Hosting, reliability and security

Hosting

The physical hosting of our primary infrastructure is provided by Equinix, the world's largest data center with more than 145 data centers around the globe. Certified by several organizations (SSAE16, ISO, LEED, Uptime Institute), Equinix guarantees an average availability rate of over 99.99999%.

Our infrastructure is hosted in data centers located in Paris, allowing excellent connectivity in Europe and particularly in France. 

Our servers are made up of hardware selected by our partner Alwaysdata, from the latest generations of professional ranges from renowned manufacturers (Intel, Western Digital, Supermicro).

Reliability

Electricity and air conditioning

  • all the equipment (network hardware, servers) are powered by two totally independent electrical chains;
  • Inverters and generators guarantee an uninterrupted power supply, even in the event of an ERDF outage on the site for several days;
  • the air conditioning of the rooms is provided by two independent chains, capable of maintaining a stable temperature whatever the outside conditions;
  • Simulations of electrical and air-conditioning failures are carried out every month to ensure the proper functioning of all equipment, including emergency equipment.

Monitoring

  • All our servers are monitored by internal and external probes (located in many countries), allowing us to be immediately alerted in case of any anomaly that could not be automatically corrected by our monitoring tools;
  • the engineers are on call 24 hours a day to intervene within minutes of detecting a breakdown;
  • Technicians are present in our datacenters, 24 hours a day, to carry out manipulations on request of our engineers.

Network

  • our connectivity is provided by 4 fully redundant network operators;
  • All our network equipment (switches, routers) work in pairs, with hardware from 2 different manufacturers, ensuring continuity of service in case of hardware or software failure;
  • Each server has a dual network connection to the switches, with automatic failover in case of failure.
  • all disks are duplicated in real time (RAID) and can be exchanged without interruption (hot-swap) ;
  • Spare hardware is available on site to immediately replace any faulty parts or even a complete server.

Security

Physics

The access to the datacenters is done in a secure way with :

  • biometric recognition ;
  • name badges ;
  • security teams.

Server

All our servers are :

  • protected by a firewall, with an automatic banning mechanism of IPs carrying out attacks ;
  • updated immediately upon discovery of a significant security breach.

Network

Our network and all our servers are protected from DDoS attacks thanks to a 4-level defense:

  • Each server is configured and optimized to be able to withstand medium sized attacks without manual intervention;
  • in case of a larger attack, anti-DDoS protections are automatically activated with our network providers, thanks to 2 distinct and redundant implementations;
  • For even more complex attacks, our engineers can define custom blocking rules, in coordination with our network providers' engineers if necessary;
  • in the event of a hypothetical extremely massive attack (several hundred Gb/s), a DNS re-routing strategy to a third party provider can be set up and is regularly simulated.

Backups

We make backups of all our customers' data:

  • on a daily basis;
  • kept for 30 days ;
  • directly accessible by our customers in read-only mode;
  • stored in external data centres, located at least several kilometres away, and managed by a separate operator.

GDPR

All measures are taken to ensure full compliance and to help you comply with the level of data you collect about your customers, employees and partners.

Specific features and measures

  • SSL encryption of communications
  • One-way password protected access with hashing / salting
  • Full encryption of client files
  • Listing and Data Centralization
  • Reserved data access control
  • Rights management by column
  • Possibility to erase data
  • Possibility of data portability
  • History of all changes (when this function is activated by the customer)
  • Logbook opening history (when this feature is enabled by the customer)
  • List of subcontractors
  • Verification of subcontractor compliance
  • Notification in case of access to data
  • Data Protection Officer
  • Register category of activities performed on behalf of client
  • Guaranteed data availability and resilience
  • Weekly tests of complete database recovery from backups
  • Full pseudonymization of data for real-world testing on pre-production servers
  • Test procedure
  • Documentation
  • Automatic daily backup running for 30 days
  • Automatic multi-site backup
  • Ability to allow contacts to view and update data with one click
  • Ability to encrypt certain columns of data with a password
  • New "encrypted" column type to protect sensitive information content
  • Admin access restricted to 2 TimeTonic Managers only (CEO, CTO)
  • New type of column "password" totally secure facilitating the creation of extranet

Features planned for the near future

  • Possible pseudonymisation of data
  • History of playback accesses by recording
  • Read access history per file
  • Export history by record
  • Export history by table

You remain in control of your data. TimeTonic provides only a tool to centralize, manage and protect it, and cannot take detailed action on your behalf.

We do not access your data, do not know your data and do not give any access to your data to third parties, unless you expressly request and invite us to do so.

More details are provided in TimeTonic's Terms and Conditions of Use.

FAQ

Security of access to information/data

What authentication means are available to access your service? 

Sesskey authentication for API access (Zapier, Salesforce, Microsoft Navision, TimeTonic internal API)

Login / Password

Possibility to use Google's single sign-on (SSO), which would allow us to connect to your service in a secure way and make authentication easier for our users (identical identifier to the email, etc.).

We prepare an SSO via OKTA at the request of a client. We are not yet Google SSO compatible but this can be studied on request of course.

If not, can you describe the password security policies for local user accounts (complexity, lifetime before renewal, password history, etc.); we would also like to ban anonymous accounts ;

The password policy for free accounts is free. For corporate accounts, a minimum of 6 characters is required, including 1 lower case letter, 1 upper case letter and 1 number.

Passwords are hashed and salted and are therefore encrypted and cannot be recovered but only replaced.

The lifetime of the passwords is 1 year.

The accounts are nominative

Is dual authentication, or strong authentication, available for local accounts?

Dual authentication is not yet available but is planned for Q4 2019 for corporate accounts.

What are the different means of access available (vpn, public, private, hybrid cloud, etc.)? Do all streams use strong encryption algorithms to guarantee the confidentiality of our data?

TimeTonic is a SaaS platform managed by Alwaysdata and hosted by Equinix in France.

Dedicated hosting is possible

All flows are done via ssl bank level encryption

Is it a shared environment with other customers or a dedicated solution? What are the means implemented to guarantee the watertightness of the different environments (virtualization, etc.)?

Data and software are hosted on our own servers and are not shared with any other company.

A very fine and very strict management of access rights prohibits access to workspaces, columns, data lines on both the client and server sides.

How does access to the service and our data work?

Client files (pdf, word, emails, etc) are encrypted and stored on disk on spaces not accessible in http, only a link is generated, kept and used as a database.

The data is managed per work area called "notebook". Each notebook has its own databases and access to the notebook is managed by specific rights management.

Access by user or user group is possible, including by view, by row, by column - e.g. some people can see all the data but not the modification history, or others can have read-only access to one part of the data, write access to another part, and no access at all to another part.

Access to files is via anonymous long URLs generated and managed in a database and therefore totally unreferenced and unsearchable by search engines - no file is therefore directly accessible.

There are two types of URLs:
- One allowing free access to the owner of the URL
- The other always requiring a valid access right via TimeTonic login / password

What software and hardware security means are implemented to guarantee the confidentiality, integrity, traceability and availability of data (IPS/IDS, SOC, Gateway Antivirus, Supervision, Log, etc.)?

The hardware and operational maintenance of TimeTonic servers is managed by Alwaysdata and the servers are physically hosted in Equinix's datacenters in France.

The SOC 2, PCI DSS, SOC 1 Type 2 (SSAE 18 replaces SSAE 16) certifications are therefore present.
Physical access in the datacenter is controlled by a security station, then by individual magnetic cards and biometric readers.
See thevideo

We use internally an audit tool (OpenVAS) to scan our servers for vulnerabilities and tools (e.g. rkhunter) to check the integrity of critical files on a daily basis.

Security of storage, conservation and restitution of information/data

Will our data be stored in a secure datacenter (ISO standard, classification of the datacenter in question, etc.)? If you have several datacenters, is it possible to choose the location of our data?

The hardware and operational maintenance of TimeTonic servers is managed by Alwaysdata and the servers are physically hosted in Equinix's data centers in France.

The SOC 2, PCI DSS, SOC 1 Type 2 (SSAE 18 replaces SSAE 16) certifications are therefore present.
Physical access in the datacenter is controlled by a security station, then by individual magnetic cards and biometric readers.
See thevideo

It is not possible to choose your datacenter.

Is the data (storage, database, etc.) encrypted?

The files are encrypted

Access to user databases by other users is impossible (except for data shared by the users themselves who have temporarily invited TimeTonic support members - themselves under strict NDAs - ) and only the CEO and CTO of TimeTonic have the administrator credentials of the servers which are modified at least twice a year. Even for the CEO and CTO we follow a strict policy of never accessing data without prior authorization from the customers.

Do you have a backup policy to send us (backup plan, shelf life, etc.)?

A 30-day rolling backup of all databases and files is made daily, and a monthly backup is made and kept for 12 months.

The data belonging to the users are kept as long as the licenses are active and then archived for 1 year unless a request is made to delete an account.

The user identification data (name, login) is kept for the duration of the licence / collection period and is deleted when an account is deleted with final payment.

How many levels of backup and restore are available (partial, full, etc.)?

The backups are total and made daily at 4am with copies of the backups on separate servers.

Restoration can be total or partial and is done on request.

TimeTonic also allows to keep the history of all the modifications made by the users (who modified what, when, and what was the previous value) which, in addition to a very useful traceability to understand the changes made, allows, on demand, to go back in a very fine way without losing the changes made during the day since the last daily backup.

A ctrl-z (undo) is also available directly by users in spreadsheet view for changes made at the moment

How long does it take to restore a previous backup? Does this restoration require your intervention? In this specific case, does a restoration incur a cost?

Catering is done on demand and takes between 2h and 8h depending on the type of catering requested (except ctrl-z instantly restoring the previous data)

Except for the ctrl-z that can be done by the users themselves, the restoration requires the intervention of TimeTonic.

The intervention is invoiced according to the time spent (in proportion to the daily cost in force, currently 950€ / day).

Are the backups tested regularly to ensure that they work?

A complete data recovery is tested every week

Continuity and disaster recovery

What are the means put in place to guarantee business continuity in case of hardware or software failure?

Complete software installation procedures are tested approximately 4 times a year and complete data restores are tested weekly.

We use pingdom to test access to the service every minute with sms and email transmission to 3 people in case of unavailability.

We use newrelic to measure response times and the number of application and database queries.

We also use our own tools that send us an SMS in case of access error, repeated unauthorized access or request for a forgotten password.

Is a secondary site present to enable disaster recovery?

Alwaysdata manages servers across multiple Equinix data centers and can restore service to other servers. We also have our pre-production servers that can be converted to production servers in 8 hours.

Do you have written PCA/PRA to send us?

Procedures are not communicated

Do you deposit the sources of your applications with a trusted third party?

The source codes of the applications are not currently deposited but this can be put in place for contracts justifying such a request.

Quality of service

What is the average OTN across your entire infrastructure? And for the service concerned?

Maximum observed service outage of 11 minutes in the last year

Observed availability rate above 99.95%.

Is a pre-production environment provided with the service?

Yes, each customer can create an unlimited number of notebooks, including pre-production.

We also have our own pre-production server.

Can you provide us with the main SLAs for the services, including:
- Availability of the application, production environments and non-production environments;
- Support availability ranges, time to resolve anomalies;

Support
- Email and telephone support is provided Monday through Friday during office hours (9:30 am to 6:30 pm CET). Support calls taking longer than 15 minutes to process are charged by the hour.
- If more than 8 hours of paid assistance are reached in a given month, a notification is sent to the customer asking whether or not the assistance should continue.
- Professional user licenses may also request on-site assistance currently in the Paris region (Ile-de-France). On-site support outside the Paris region (Ile-de-France) will incur additional business, travel and processing costs.

SLA
- Pro licenses include the following service availability (online access)
- Guaranteed Response Time (GRT): 60mn (during support hours) - GST
(Guaranteed Service Access Repair Time): 2h (during support hours) - Monthly Guaranteed Service Availability
: 99.5% (during support hours) - Bugfix
Repair Time is not guaranteed, but we will of course make all commercially reasonable efforts to fix bugs.

How are the upgrades done?

Specifications, tests on developers' workstations, unit tests, functional tests, merge with master, tests on pre-prod server, release on production server and complete tests after 6pm, one click backwards if necessary.

Continuity of service RPO, RTO

Contact Alwaysdata in case of general access problems. Alwaysdata has an excellent service available also in case of emergency.

Direct access by CEO/CTO for log analysis / re-installation of previous versions/database

Reversibility of our data

Do you have processes and procedures in place to ensure the reversibility of data?

Yes, see above

What support do you offer your clients?

Admin training to be able to create or manage your own applications / business processes in total autonomy,

Professional services to assist in the design and creation of applications / business processes

Training / documentation for users

On-site or remote support

Data import help

Export help / data restitution

Specific developments

Interfaces with your existing tools (we have already created interfaces with MS Navision, Office, Google, Dropbox, and Salesforce in particular)

In what format is the data returned?

Export csv / xml for data, ZIP for files

Is there a cost for data recovery?

Yes, the intervention is invoiced on a time basis (in proportion to the daily cost in force, currently 950€ / day).

We would like to carry out periodic reversibility tests (2-4 times a year), what is your position?

It's possible

Compliance

Do you comply with the requirements of the European Data Protection Regulation (GDPR)?

Yes, see above

Is the data storage in the EU Zone?

Yes, in France

What commitments do you make regarding the ownership and use of the data?

All your data belongs to you and no one else has access to it unless you specifically request it or unless you ask for justice.

You can request the return of your data and the destruction of all your data at any time.