Is my data safe and secure with Diliforce?
All files uploaded to Diliforce are encrypted using AES-256 before they are stored, and every connection to the Diliforce service is encrypted using TLS 1.2 or newer. The Diliforce Governance Suite is hosted on Microsoft's Azure cloud platform in the European Union, with the primary region in the Netherlands.
Read more about Microsoft Azure Security:
https://azure.microsoft.com/en-us/explore/trusted-cloud/
More details on Diliforce & Microsoft Azure Security
Customer data security and privacy are of paramount importance for Diliforce. Diliforce is a governance platform: it holds an organisation's contracts, board and meeting materials, entity records and virtual data rooms, which makes information security central to everything we do. The security of the solution is ensured on many levels, from regulatory requirements to architecture and the solution's physical security.
The following sub-chapters describe the steps taken to ensure the security of the solution.
DESIGN SECURITY
The security of the Diliforce solution starts with a secure technology foundation. The solution has been designed with security in mind from the ground up. All outward-facing interfaces are hardened against attacks, and the Microsoft Azure platform aids in protecting against and mitigating
attacks. The Azure platform evolves and is updated constantly, which in turn minimises security risks caused by open vulnerabilities on the platform.
The Diliforce solution has been developed following Microsoft Azure best practices and Microsoft's web application architecture guidelines. These guidelines ensure that Microsoft's global incident response teams are able to mitigate the effects of any attacks against the security of the Diliforce solution as a whole.
User passwords are never stored in clear text; they are stored as salted bcrypt hashes. Single sign-on through Microsoft Entra ID and Google is supported. The web application enforces HTTPS, HTTP Strict Transport Security and a Content Security Policy in the browser.
No payment card data is held by Diliforce, as all payment card processing is subcontracted to Stripe, a PCI-DSS-certified payment card processing vendor.
DEVELOPMENT SECURITY
During the development cycle the Secure Development Lifecycle is utilised. This is a mandatory development process that embeds security requirements into every phase of the development process. The application development takes into consideration the OWASP Top 10 vulnerabilities and mitigates the possible effect of those.
An incident ticketing system is used and all tickets that might have security implications are tagged. All tagged tickets need validation from a security responsible to be closed.
CLOUD SECURITY
The Diliforce solution's health is monitored with a centralised monitoring system providing continuous visibility into the status of the system. The system alerts the management team in case of incidents.
Diliforce runs on Azure App Service, a managed platform where Microsoft patches the operating system and runtime. Azure's infrastructure-level DDoS protection covers all of the service's public endpoints.
All connections to the application and between its components are authenticated and encrypted. Administrative access to the production environment is restricted to named personnel and is logged.
DATA SECURITY
Diliforce runs on Microsoft's Azure cloud platform. The production environment is located in the Azure West Europe region (Netherlands), with geo-redundant copies of files and database backups held in the Azure North Europe region (Ireland). Optional AI features are processed by Azure AI services in the European Union (Sweden Central and West Europe); the optional Claude models and how they handle your data are described in our article "AI Assistant and Privacy – What You Need to Know": https://contractzen.uservoice.com/knowledgebase/articles/2010707
All of this is within the strong EU data privacy laws.
Microsoft Azure, as the underlying platform, meets key international and industry-specific compliance standards, such as ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 1, SOC 2 and SOC 3, and FedRAMP. It also meets regional and country-specific standards and contractual commitments, including the EU Standard Contractual Clauses (formerly the EU Model Clauses), UK G-Cloud, Singapore MTCS and Australia IRAP. Read more: https://learn.microsoft.com/en-us/compliance/regulatory/offering-home
The SQL database uses the Azure SQL Database built-in Transparent Data Encryption, which uses AES-256 symmetric encryption to encrypt all data files. (Read more on TDE: https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-tde-overview)
The Azure Cosmos DB NoSQL database is encrypted at rest by default using AES-256. (Read more: https://learn.microsoft.com/en-us/azure/cosmos-db/database-encryption-at-rest)
All connections to both databases are also encrypted in transit with TLS (Transport Layer Security, the same protocol used when accessing any website over HTTPS).
Files uploaded by users are stored in Azure Storage, which has encryption enabled at rest using AES-256. In addition, every file is encrypted with its own AES-256 key before upload, and that key is protected with a customer-specific encryption key that is stored in, and never leaves, the Azure Key Vault service.
BACKUP AND DISASTER RECOVERY
Files are stored in Azure Blob Storage configured with Read-Access Geo-Redundant Storage (RA-GRS), so a copy is kept in a second Azure region to ensure availability and durability even during a regional outage. Soft delete is enabled, which protects deleted files by retaining them for 7 days after deletion.
The SQL database supports point-in-time restore for the past 35 days, and monthly long-term backups are retained for 5 years. These backups are stored on geo-redundant storage managed by Azure, so the data remains recoverable even in the event of a regional outage. The Cosmos DB database is kept in multiple replicas within the region and supports continuous backup with point-in-time restore for the past 7 days.
If you want to have a backup of your data, you can have it anytime you want. Please send us a message and let us know the account name and the administrator to whom we will deliver the data. We will deliver your data (with the metadata) to you electronically in a structured form. The cost is 75 € / $85 + VAT per delivery. However, if you want to stop using our service, we will deliver the data to you for free.