How is security managed ?

The security of the Astn’go solution refers to the protection of the application, data and virtual infrastructure hosted in the cloud.

The solution

Infrastructure security

The Astn’go solution infrastructure is protected by a firewall and benefits from all the protections offered by Amazon AWS. It is thus resilient to DDoS attacks by detecting and filtering any abnormal traffic.

Security through code and DevOps tools

The Astn’go solution is developed in accordance with the recommendations of the OWASP Foundation (Open Web Application Security Project), in particular by taking into account the “OWASP Top10” risk awareness document. In addition, all external dependencies used for its implementation are checked daily using the OWASP Dependency Check tool in order to detect and correct any new security flaws as soon as possible.

Security through authentication

The authentication process of users to the solution is done securely through a trusted third party authorized (use of the protocol “OAuth 2.0 authorization framework”) and in compliance with the RGPD regulation. As for the IIoTs, they authenticate themselves to a secure service on the Astn’go Cloud infrastructure.

User security

A role management mechanism allows you to restrict access to certain pages depending on the user connected.

The data

Where are the data located ?

Astn’go uses Amazon AWS as its cloud infrastructure provider. Your data is stored as close as possible to your site, in a European datacenter located in Ireland.

How are the data stored ?

Astn’go’s storage model is based on a multi-tenant architecture where your data is isolated from the data of other companies using Astn’go. Thus you do not take the risk of exposing your data to others or to consult the data of other companies. The global data necessary for the proper functioning of Astn’go are stored in a shared model.

Who owns the data ?

The data you collect with Astn’go is yours :

• We do not use your data other than for the purpose for which it was collected by Astn’go.
• We do not share your data with any third party.
• Your data is only accessible by you and your teams and, occasionally, by our support team when you request it.

Each user is in control of the creation, modification and deletion of his personal data as well as the data related to his activity.

How is the data secured ?

The data is above all secured by an application structured around security. The data hosting is protected by a firewall that secures access. Your data transit between your production site and the Astn’go application via secure communication protocols such as HTTPS and WSS. All data stored on Astn’go production servers is encrypted using the AES-256-GCM encryption algorithm, a cryptographic industry standard. Finally, your data is replicated and backed up in order to secure it in case of system failure.

Are there any incoming data ?

An incoming data is a data coming from Astn’go and entering the production site. No data or signal enters the industrial infrastructure via the IIoT. Incoming data only concerns display data for users via the internet browser of the terminal, tablet or PC.

What happens to your data if you stop your subscription?

At the end of your subscription, you have 30 days to recover your data by sending an email to support@astngo.com. If no claim is made at the end of this period, the administrators of Astn’go will delete the databases and backups according to our procedures.

Data backup policy

Your data is backed up every 12 hours with a retention period of 7 days and is also replicated between different availability zones. Moreover, only Astrée Software administrators have access to Astn’go production servers.

Our commitment to confidentiality and RGPD compliance

Astn’go does not record any personal data other than name, first name, email, telephone, date of birth and address. Astrée Software has a RGPD contract available on request. The name of the DPO designated by ASTREE SOFTWARE is mentioned in our privacy policy : ici.

Under normal circumstances, our employees do not have access to your data. Our teams can access your data during interventions to maintain Astn’go in operational conditions. If you have not given your authorization beforehand, there are two potential situations that trigger an access authorization to our employees :

• If our teams discover a problem or a malfunction.
• If you request assistance from our teams.

In these cases, our teams also ask you for temporary permission to extract an anonymized copy of your data in order to address the problem. Any copy made is destroyed in accordance with our procedures within 14 days of the intervention.

Confidentiality is at the heart of our company’s processes: regular awareness-raising, formal commitment, etc. Whether through an internship agreement or an employment contract, but also by signing our IT charter, all our employees are committed to confidentiality.