Intempus ISAE 3000 TYPE 2 declaration
General Data Protection Regulation (GDPR), or in Danish “General Data Protection Regulation”, is the name of the EU data protection legislation. The GDPR aims to protect EU citizens from misuse of their personal data. Therefore, since 25 May 2018, all European companies must have strengthened their processes for how personal data is collected and processed securely. Intempus has the following certifications:
- ISEA 3000 declaration
- ISEA 3000 TYPE 2 declaration
Intempus APS opinion
Intempus ApS handles the processing of personal data in connection with the Intempus time registration platform for our customers who are data controllers under the Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) and the Act on supplementary provisions to the General Data Protection Regulation (Data Protection Act). The accompanying description has been prepared for the use of controllers who have used the Intempus time registration platform and who have sufficient understanding to assess the description together with other information, including the technical and organisational security measures and other controls that the controllers themselves have implemented, when assessing compliance with the requirements of the GDPR and the Data Protection Act.
Intempus ApS uses sub-processors. The relevant control objectives and associated technical and organisational security measures and other controls of these sub-processors are not included in the accompanying description. Intempus ApS confirms that the accompanying description in section 3 provides a true and fair description of the Intempus time recording platform and the associated technical and organisational security measures and other controls as of 15 November 2021.
Questions and answers
FAQ about data processing and data protection
How does Intempus back up customer data?
Intempus performs backup of data using two independent backup systems. Each backup system sends backups to two different storage locations for a total of four separate backup locations.
A daily full backup is created using the pg_dump tool. These backups are stored on two different servers for 12 months. Once per week we restore one of these backups to a test system to ensure we always have good backups.
Continuous backups are created using the barman tool. This ensures new data is backed up within a few minutes of being created. These backups are stored on two different servers for 2-3 weeks. Barman monitors that the required backups are present and alerts us if backups are not being performed.
How does Intempus protect user passwords?
Passwords are stored in our database using an iterated salted hash algorithm. This means that even Intempus system administrators cannot read your password from the database. The algorithm being used is known as PBKDF2-SHA256.
Intempus performs a calculation of the complexity of passwords entered by users. This is known as an entropy estimate. The calculation makes use of a third party database of passwords previously leaked from other systems. That database is named Have I Been Pwned. Intempus use the offline version of the database in order to protect against potential leaks through the HIBP API.
Each Intempus customer can choose a minimum password strength for their users. Intempus will enforce this policy when a user updates their password. The calculated entropy will not be stored by Intempus after the validation has been performed.
To protect against brute force attacks and credential stuffing Intempus will enforce a global rate limit on invalid login attempts. When the limit is exceeded the client IP address is temporarily blocked by Intempus. If necessary a range of multiple IP addresses will be blocked. The decision to block based on IP addresses was made because this is more accurate than blocking based on usernames.
Does Intempus support single-sign-on?
Intempus has support for Microsoft SSO. A customer using SSO can choose to either require their users to use SSO or to give users a choice between SSO and password logins.
How does Intempus encrypt customer data?
Communication between Intempus and users is encrypted using transport layer security (TLS). Customer data exchanged between different parts of Intempus is encrypted using either TLS or SSH.
The storage server used by our database is encrypted by the hosting provider transparent to Intempus.
What certifications does Intempus have?
Intempus has a ISAE 3000 type 2 certification.