Version 2. (09.09.2022)
1. Introduction
2. Confidentiality
2.1. Admittance control
2.2. Access control
2.3. Authorisation control
2.4. Separation control
3. Integrity
3.1. Transfer control
3.2. Input control
4. Availability and capacity
4.1. Availability
4.2. Capacity
5. Procedures for regular checking, assessment and evaluation
5.1. Data protection management
5.2. Incident response management
5.3. Data protection-friendly default settings
5.4. Secure software development process
At New Work SE, the following technical and organisational measures for data security as per Article 32 GDPR apply with regard to onlyfy data processing under joint controllership.
The structure of the document complies with GDPR specifications. Where deemed appropriate, New Work SE engages carefully selected service providers to perform technical and organisational tasks. New Work SE performs maintenance and ongoing development of the onlyfy software.
New Work SE grants access rights in line with an internal role management concept based on the principle of least privilege. A policy is in place to ensure that access is only granted as and when needed (e.g. to process a support ticket). System access is logged and traceable.
The following measures apply to New Work SE’s offices:
One of our sub-contractors operates onlyfy and handles actual data processing. Sub-contractors hold ISO 27001 certification and provide an appropriate level of protection with a view to admittance control for their data processing facilities.
Applicants
Applicants can only view and adapt their own data. Depending on the settings chosen on registration, a password is either generated automatically or chosen by the applicant. The password can be reset through access to the email address given on registration. The password policy for applicants is:
Users
onlyfy offers two types of authentication for users. On the one hand, there is single sign-on via SAML 2.0, in which the customer can configure the security level and integrate an authentication system of his or her choice. Authentication is set to email and password by default. The password can be reset through access to the email address given on registration. The standard password policy is the same as that for applicants.
User-defined password policies can be implemented in the onlyfy application. The following can be defined:
The number of password changes after which a password chosen previously can be reused
Customer managers
The login to the onlyfy application for customer managers is set up with email and password, as it is for users. The password policy, however, is prescribed by onlyfy as follows:
Server administrators
New Work SE prevents unauthorised access to theonlyfy servers by using RSA keys. Authorised New Work SE administrators have a personal key with which they can connect to the servers that they need for their work. A key is restricted to one device – and the keys are also password-protected. Our key rotation strategy complies with the OWASP recommendations. When issuing keys, we follow the principle of least privilege, meaning that employees only have access to the systems that they absolutely need.
Users
Authorisation control is implemented by the system in accordance with the customer’s configuration. onlyfy offers a role and authorisation system that customers can configure themselves in the application. The customer is responsible for allocating and periodically checking the authorisations. User access to the application is logged.
Customer managers
New Work SE is responsible for authorisation control for customer managers. Organisational onboarding and offboarding processes are used to ensure that allocated authorisations are up to date. All allocated authorisations are also checked at regular intervals. Customer manager access is logged.
System administrators
New Work SE is responsible for authorisation control for system administrators. Organisational onboarding and offboarding processes are used for new and departing staff to ensure that allocated authorisations are up to date. All allocated authorisations are also checked every month. Login times for system administrators are logged on all servers.
All New Work SE employees are obliged to maintain data confidentiality; this obligation also remains effective after their departure.
Test and production data and environments are hosted on separate networks to ensure clear separation. Within the production environment, the onlyfy application itself uses comprehensive authorisation management to ensure that respective user groups (applicants, enterprise users with various authorisation groups) can only access relevant data for the given client.
New Work SE follows the principle of least privilege for transfer control. The productive data are kept exclusively in the production and backup system. Data are always transferred over encrypted channels which prevent unauthorised reading, copying, alteration or removal of data by technical means. Backups are encrypted before transmission.
Every request from authenticated users and applicants in the application is logged. As a result, modifications and erasure of data can be tracked. This also applies to New Work SE employees. Login times of system administrators are logged on the servers.
High availability is crucial for the success of onlyfy. As a result of frequent integration of software into customer web pages (e.g. job widget), the availability of onlyfy affects the availability of job or career sections on the homepages of our customers. onlyfy offers high reliability by using certified infrastructure providers. The architecture of the application is also designed for high availability. Single points of failure, i.e. software and hardware components that limit the availability of onlyfy if they fail, have been avoided by means of redundant infrastructure.
Database backups are stored every two hours, files every 24 hours. We combine full storage with incremental backups. Backups are replicated on three different machines and are imported into a test system at least every six months for testing.
Monitoring systems are used to swiftly identify and mitigate anomalies and issues that limit availability.
The capacity of onlyfy is ensured by regular capacity and resource planning in the infrastructure.
New Work SE has a data protection management system in place which is updated constantly as a result of close collaboration by all of the relevant departments (in particular the Group’s data protection officer, data protection coordinators, and IT security team).
Employees are trained annually or if there are relevant innovations.
Incidents relating to data protection are handled according to a defined process. New Work SEwill comply with any official notification obligations arising in connection with an incident. In the wake of an incident, a post-mortem of the New Work SE application will be performed to derive and introduce measures to improve the application and processes based on the specifics of the incident.
The application supports data protection processes at many points. The default settings provide for minimal data collection and automated data erasure after appropriate periods. onlyfy supports customers in configuring the system in accordance with specific requirements relating to data protection.
State-of-the-art tools are used in the New Work SE software development process to ensure that new functions and features are secure. Such tools include static code analysis, automated vulnerability scans for connected libraries, and automatic patching. Other tools include code reviews along with manual and automated quality assurance processes prior to a release.
An external agency performs an annual penetration test on onlyfy to identify and vulnerabilities in the application. Critical findings are subsequently analysed and rectified, then validated by the agency. New WOrk SE also runs a white hat bug bounty where IT security experts receive a reward for identifying vulnerabilities.