How we protect the data you move with us

Micromerce migrates customer data from one software system into another. This page shows how we protect that data: our security controls, our policies and the service providers we work with.

ISMS per ISO/IEC 27001, certification in preparation · GDPR processor under Art. 28

Security controls

What protects your data today, grouped the way a security questionnaire asks for it.

Data security

5 controls

Encryption in transit
HTTPS on every connection.
Encryption at rest
File storage, databases, backups and compute disks are encrypted with AES-256.
Platform backups
Point-in-time backups, so the platform can be restored to an exact moment.
Customer backups
Each customer's data is backed up every six hours, with a copy in a separate AWS account.
Only the data needed
A migration takes in only the data it needs, on your documented instructions.

Access management

5 controls

Access by role
Roles decide what a person can see. Only administrators and data engineers see source data in plain text; every other role sees only anonymous values.
Least privilege
Every role gets only the access its tasks require. Roles that do not work on migrations have no access to migration data.
Phishing-resistant sign-in
Employees sign in through single sign-on with a hardware security key.
Expiring download links
A link to a file expires after 15 minutes by default, 60 minutes at most.
Audit logging
Every plain-text read of source data and every change to migration data is logged. In production, audit logs are write-once and kept for 10 years.

Infrastructure

4 controls

Hosting in the EU and US
The platform runs on AWS in Frankfurt (eu-central-1), spread across several availability zones. For US customers, all data is processed and stored in N. Virginia (us-east-1).
Threat detection
AWS GuardDuty watches our cloud accounts for suspicious activity.
Secrets management
Credentials and keys are kept in AWS Secrets Manager and encrypted with AWS KMS.
Separate test and live access
Test imports and live imports into your target system use separate credentials.

Endpoint security

3 controls

Managed company devices
All company laptops are centrally managed: security settings are enforced, and a lost device can be locked or wiped remotely.
Endpoint detection and response
EDR software on company laptops detects threats and responds to them.
Password manager
Company passwords are kept in a password manager.

Incident response

4 controls

Breach notification
If a security incident affects your data, we tell you without undue delay, so you can meet your 72-hour duty under Art. 33 GDPR.
On-call duty
A named person is on call during business hours, with a defined escalation path.
Post-mortems
Every significant incident gets a written, blameless post-mortem. Each follow-up action is tracked until it is done.
Incident exercise
A tabletop exercise tests the incident process once a year.

Governance

4 controls

Information security officer
A named information security officer runs the ISMS.
Risk register
Security risks are recorded, owned and reassessed on a fixed cycle.
Supplier assessment
Every service provider that processes personal data on our behalf is risk-assessed.
Security awareness training
Every employee, every year: phishing, handling data and reporting incidents.

Policies

Management approves these policies and reviews them at least once a year. As a customer, you get the full text on request.

Information Security CharterRequest: Information Security Charter
Information Security PolicyRequest: Information Security Policy
Organization of Information Security PolicyRequest: Organization of Information Security Policy
Risk Management PolicyRequest: Risk Management Policy
Personnel and Access Management PolicyRequest: Personnel and Access Management Policy
Information Classification PolicyRequest: Information Classification Policy
Cryptography PolicyRequest: Cryptography Policy
Secure IT Operations PolicyRequest: Secure IT Operations Policy
Secure Cloud Usage PolicyRequest: Secure Cloud Usage Policy
Secure Development PolicyRequest: Secure Development Policy
Supplier and Third-Party PolicyRequest: Supplier and Third-Party Policy

Sub-processors

The service providers that process personal data on our behalf.

Amazon Web Services
Hosting of the Micromerce platform and all migration data
Google Workspace
Email and file storage
Microsoft 365
Office documents and video calls
Atlassian
Support tickets and internal documentation
Slack
Internal communication
HubSpot
CRM for sales and customer contacts

Questions about security?

Write to us for security questions and document requests, or to report a suspected vulnerability or incident.

security@micromerce.com

As a customer, you get these on request: the data processing agreement with its annex of security measures, and our statement on how migration data is handled, including retention and deletion periods.