Security
Where your data is and who can see it
An internal communications tool ends up holding payslips, procedures and what your workforce thinks of the company. Here is exactly what we do with that data.
Where your data is
- Servers in the European Union, with no transfers outside the EEA.
- The database is reachable only from the server itself, never exposed to the internet.
- Backups stay inside the same jurisdiction.
- No third parties analysing the content of your communications.
Who can see what
- Every database query carries the company identifier: as far as your session is concerned, another organisation's data does not exist.
- Six roles with different reach, and the safeguards are checked on the server, not just on screen.
- Files are not public: every download re-checks the session and who the file belongs to.
- An audit log of joiners, leavers, role changes and approvals.
Credentials and sessions
- Passwords are not stored: what is stored is a scrypt derivation with a salt per user.
- The session identifier is stored encrypted; a dump of the table lets nobody impersonate anybody.
- A temporary lockout after several failed attempts.
- Changing the password closes any sessions left open on other devices.
Anonymity in surveys
- When a survey is marked anonymous, the answer is stored with no link to the person.
- Neither an administrator nor we can rebuild who answered what.
- The trade-off is that you lose the breakdown by department, and the screen says so.
- It is the only way an engagement survey is worth running.
Infrastructure and sub-processors
Blastack's servers are hosted by third parties, and each of those third parties holds its own certifications. Here is who is who and what each one does, with the name of the holder in front of every certificate so that it can be checked against its registration number.
Infrastructure provider
Hostinger International Limited
- Hostinger International Limited is the company the data processing agreement is signed with, and the holder of the autonomous system the server belongs to.
- Hostinger International Limited is certified to ISO/IEC 27001:2022. The audit is signed by TÜV Thüringen.
- The scope of that certification is Hostinger International Limited's own: its infrastructure and its processes.
It can be checked without going through us, in their trust centre: trust.hostinger.com.
Data centre operator
Digital Realty
- The building the servers sit in is a Digital Realty data centre in Paris (France, European Union).
- Digital Realty holds ISO 27001, ISO 14001 and ISO 50001 certification for that centre.
- It operates the building and its facilities. It is not the server provider and it plays no part in the service.
Every certification in this section is held by the company named directly above it, and covers that company's own infrastructure. The holder goes in front on purpose: a certificate with no holder cannot be checked, and in a tender that is worth the same as not bringing one.
What we still don't have
We would rather say it here than have you find out in a meeting. Today we have no ISO 27001 certification and no SOC 2 Type II report; we have no two-step verification of our own, though anyone signing in with their company account goes through their provider's conditional access; and we don't speak SAML 2.0 — single sign-on runs over OpenID Connect, which covers Microsoft Entra ID, Google Workspace and Okta, but if your tender requires SAML in writing, that we haven't got. All three are on the roadmap, with no date committed.
If any of those three is a must-have for you, email us and we'll tell you where it stands.
The full list of what we don't do today, with the detail on each one, is in the frequently asked questions.
Specific questions from your IT department?
We're happy to fill in security questionnaires. Email us and you'll get an answer in writing.