Safety and security

Security & privacy

Data security at Storegate

Cloud guarantee with integrity and security in focus
Storegate’s customer data is stored in a reliable environment with alarm and protection class 3 where customers can make maximum use of the services in a safe, secure and efficient manner. The equipment is owned by Storegate and the data centers are located in Sweden.

Facilities, systems and personnel meet tough requirements and we offer a fully redundant environment with optimal conditions in terms of power supply, cooling, climate, fire detection and extinguishing systems.

Storegate’s services are monitored around the clock via surveillance systems. If disruptions occur in operations, the technician on call is automatically alerted. Access to data centers is protected by access control systems, internal sectioning and burglar alarms.

Storegate works together with independent consultants for ongoing penetration tests, vulnerability assessments and tests according to standards such as OWASP TOP TEN.

Storegate has a forum called ISWG (Information Security Work Group) that works on designing and implementing processes for Storegate’s ISMS system. Contact us for more information.

Storegate never scans information for business development purposes or to sell advertising.

Account access and authentication
When you create your account on Storegate, we have created the conditions for you to choose a strong username and password that is adapted to your company’s policy.

• Password factors (minimum number of characters required by numbers, special characters capitalization, etc.)
• Password reset from the administrator or via support
• Limited number of login attempts (brute force)
• Automatic logout in case of inactivity
• Token-based Oauth login for clients and web
• Two-step verification with apps that support the TOTP protocol, e.g. Microsoft and Google Authenticator

Single Sign On
For Enterprise customers, Storegate offers support for Single Sign On. This gives companies centralized control over user accounts in Storegate. If a company disables a user centrally, the person can no longer log in to the service. Similarly, you as an administrator can manage and control your users. This is done by logging into your administrator account on Storegate.com.

Mobile access
Mobile users can access their Storegate accounts via mobile browsers or a specific Storegate app. When a user connects via a mobile phone (iPhone, iPad, Windows, Android, etc.), HTTPS encrypted authentication is applied. All data sent between the server and the mobile application is encrypted using the TLS banking standard. If a mobile device is stolen or lost, the administrator can block the person’s account so that access to the information in the service is blocked in real time.

Upload and transfer
Once you have logged in to the service via one of our interfaces, you can upload files and folders. The upload itself is simple when viewed from the user’s perspective, but we at Storegate optimize performance and security in the transfer itself. All data is encrypted with 128-bit TLS encryption. This means that you don’t need to use VPN tunnels or similar to access your data from different geographical locations. The same procedure is reversed when downloading files to your devices.

Permission levels and information sharing
Once your files have reached Storegate and are ready for sharing, collaboration or storage, there are options to decide who and what should have access to the information. For example, each user can set sharing permissions in collaboration folders. By sharing folders externally, you can also decide who and which partners can access your information and upload information to your account. Distributions can be limited by time intervals and passwords that the recipient needs to access the content.

Global settings
At a global level, administrators can set certain restrictions on one or more users. In addition, the administrator can decide:

• Who can create folders or upload files
• Which users to invite to the account
• How much each user is allowed to store in the home directory and in the backup section
• Which files to permanently delete (active/inactive recycle bin)
• How many versions of each file should be in the account
• When and who should have reports on the status of backup
• When to delete a user

Storage and encryption
All files uploaded to Storegate are stored in real time on two separate systems located in two physically separate data rooms and encrypted on disk using AES 256-bit encryption. Furthermore, all files are stored in the systems with scrambled paths and file names. This means that it is never possible to trace which files and references belong to the owner of the files, i.e. the account holder. For all services and protocols on Storegate, 128-bit TLS encryption is also applied during transmission. For Backup Pro, files are optionally encrypted with a user-generated encryption key (256-bit AES encryption). The system has built-in protection against SQL injection and brute force attacks. The system will automatically block failed login attempts that are repeated based on IP address and username.

Shared responsibility for data protection and compliance requirements
Security and availability are our top priority at both the organizational and functional levels of the services we offer. However, many companies are subject to local or industry-specific regulatory requirements for data storage and backup, which may require backup and storage policies, which you as a customer must accommodate. Storegate, like other leading cloud services, operates under a shared responsibility model for data protection and compliance. This means that Storegate is responsible for protecting the service and infrastructure, while the customer is responsible for protecting their own data for compliance or against access issues, accidental deletion, malicious activity and other data loss events. Therefore, we recommend that each individual customer provides a backup to a third-party solution or to a local disk at home. Through the Extended Access add-on service, all files and folders (including sub-users’ My Files directory) can be backed up locally or to a third party. Contact us for more information.

Deletion of stored information
When files are in the recycle bin, they remain there until you choose to empty all or part of the recycle bin. If you delete files from the recycle bin, they can never be recreated. If you choose to close an account, the data is saved for 60 days, after which Storegate deletes all data in accordance with GDPR.

Our guidelines
The security of your information starts in our office, in our data centers and with our procedures. All Storegate employees have an employment contract that includes confidentiality towards our partners and customers. Like most online services, we have a small number of employees who need to be able to access user data for the reasons set out in our user agreement (e.g. when we are legally obliged to do so). But these are rare exceptions, not the rule. We have strict policy and technical access controls that prohibit employee access except in these rare cases. In addition, we use a number of physical and logical security measures to protect user information from unauthorized access.

Storegate also works to maintain the security of its own office network:

• Network intrusion detection systems
• Application logging, reporting, analysis, archiving and preservation of data
• Continuous monitoring

Administration of your data
Storegate technicians or customer support may occasionally need access to customer accounts to handle technical issues and support. Here, too, we have established careful policies and authorizations that help us help you with as little transparency as possible.

Application and hardware architecture
In each data center, Storegate maintains full redundancy in terms of load balancers, routers, servers, switches and failover configurations, etc. Data that is written is replicated in real time on multiple servers.

Summary
Storegate’s system is a complex environment that requires multiple layers of security. From hardware such as storage systems to soft values such as the staff working at Storegate. Storegate’s top priority is and remains the security of customers’ digital information. If you need more information in a specific area, please contact Storegate and we will be happy to answer your questions.