PRIVACY AND GDPR:
Privacy is "The ability of an individual or group to seclude themselves, or information about themselves, and thereby express themselves selectively"In our system, everyone owns their data, whether related to the business or themselves. Usually, managers handle business data, and employees have their individual data. People are responsible for keeping their data safe and sharing it with others, following privacy rules like GDPR and business ethics guidelines. You can even choose to remove your data once your involvement ends. This way, you control your information, and the system keeps some basic data to improve things while following GDPR rules. It's like being your own legal representative for your data.
This is the design pattern that is core to Hira. The platform is built for the individual to be in control of their own data: how it is generated, for what it is used, who has access to it and what others are permitted to see and use it for (and for how long).
Hira is GDPR compliant - and then some...
• Continuous Impact Assessment: Built into core design & development.
• Protect by Design: All information is managed and controlled by user him-herself.
• Data Breach Notification: MS Azure regulations & governance (Data Center in Germany); wrapper routines from Hira.
For more on how Microsoft Azure work with Data Privacy, https://azure.microsoft.com/en-us/blog/protecting-privacy-in-microsoft-azure-gdpr-azure-policy-updates/
- Personal Data
Is any information relating to an identifiable person who can be directly or indirectly identified, in particular by reference to an identifier.
Hira separates any personal data from other data and persists it in an encrypted format. The data is encrypted both at the database level and in the business layer - meaning that even if some by has access to the database and is able to decrypt the data there they still can not read it.
- Data Portability
Information associated to or generated by an individual should at any time be available for export in a structured (machine readable) format.
Hira provides tools to the users so that they at any given time can export all (or parts of) their own data in a machine readable format (JSON format). This export can be done at any time, with keeping your account or when enforcing your right to be forgotten (see below).
- Consent
Information associated to or generated by an individual is owned by that individual and needs consent to be used for anything by anybody else.
Hira encapsulates all the data you generate on the platform and nobody have access to any part of that without your consent. The platform allows you at any given time to share all or parts of your data with anybody for a period of time or until that permission is removed manually. You can decide to share data without revealing your identity or with your identity. A user can also request access to another user's data, but that can only be granted by the user in question.
- Right to be Forgotten
An individual user should at any time be allowed to remove all information associated to or generated by that individual.
Hira lets you at any given time decide to delete your user on the platform and erase all traces of you ever being a user. You can when erasing your data decide to keep a copy of that data and the system will send that to your e-mail account for storage (Data Portability).
SECURITY:
The Hira platform meets all industry standards to safeguard your data. It is all built on top of the Azure platform leveraging the world-class security put in place by the Microsoft Corporation; hosted in Datacenters in Azure West-Europe - or more precisely Germany.
On top of leveraging the Azure security framework we have applied Security by Design and added additional features and measures to to keep your data safe.
- Data stored in the Hira cloud systems are stored in Microsoft Data Centers in West-Europe (Germany) and follows local European regulations and requirements regarding the protection of data privacy.
- Network and server security is based on Microsoft Azure security.
- Web APIs and web pages are secured with High Assurance SSL certificates that support encryption algorithms with key lengths up to 256 bits and prohibit any key lengths shorter than 128 bits.
- Web APIs and web pages are secured with strong user, password protection, and token security measures.
- Industry-standard (symmetric and asymmetric) encryption algorithms with appropriately sized keys are used to protect sensitive Customer Information.
- Data is encrypted both at the Database level and in the Business layer.
- The Hira platform undergoes regular internal source code audits.
- Data retention and disaster recovery are designed using world-class services from the Azure platform.
- Organizational security is designed and implemented based on best-in-class patterns.
For more information about Microsoft Azure Security, https://docs.microsoft.com/en-us/azure/security/