Security

Digitoo and security

At Digitoo, we encrypt all communications, salt, and hash passwords and work only with partners with high-security standards. We only use accounting documents to improve data extraction. All traffic and data are stored securely on Microsoft Azure. We use multi-factor authentication and monitor overall traffic.

Encrypted communication

All communication outside our virtual private network on the Azure platform is conducted via TLS security protocols. Encrypted communication between our users and the server is ensured through the HTTPS protocol. We use the encrypted SSH protocol for service work.

Microsoft-managed keys protect your data by default, and customer data stored on physical media is always encrypted using FIPS 140-2 compliant encryption protocols. Customers can also use Customer Managed Keys (CMKs), double encryption, or Hardware Security Modules (HSMs) to increase data protection.

All data transmission between data centers is protected using IEEE 802.1AE MAC security standards to protect against physical man-in-the-middle attacks. To maintain resiliency, Microsoft uses multiple network paths that sometimes cross geographic zone boundaries, but customer data replication between regions is always carried over encrypted network connections.

In addition, to minimize the risk of privacy breaches, Microsoft generates pseudonymous identifiers that enable it to offer global cloud services (including service operation and improvement, billing, and fraud protection). According to pseudonymous identifiers, it is not possible to directly identify individuals, and access to customer data that identifies individuals is always protected in the manner described above.

Data protection

We protect our company's data with the security standards of the OWASP security organization. All Digitoo employees and partners are bound by confidentiality and security during data handling.

Access to our internal systems is protected by multi-factor authentication (2FA). We use shared password management software for passwords and secrets. We control and monitor all access to the systems remotely.

Retention of unnecessary data

By default, we keep unnecessary data for 10 years. Data is used only to improve the extraction, training, and optimization of algorithms. If necessary, at the client's request, we can delete the data at any time.

Data access

All-access to user data is limited by authorization. Each user is authorized with a unique username and password. We require the recommended complexity (OWASP) for the password and check that it does not match the username. All passwords are salted and hashed according to industry standards.

Communication between Digitoo and ERP takes place through integration agents. The agent uses an authorization token for limited data access. We monitor each access, and any such token can be deactivated immediately.

Data storage

All data is stored on Microsoft Azure servers, a very well-known provider of hosting and cloud services. Microsoft Azure meets the highest security standards. Read more about data storage.

As part of data recovery during unexpected events, we have a backup system with a 30-day retention period. We use the so-called soft delete concept to manage deleted data within our system effectively.

Microsoft Azure allows you to specify where customer data will be stored and processed. Microsoft may replicate customer data to other regions for resiliency but will not store or process it outside the selected geographic area.

Digitoo has limited the geographic area of the data to Europe. With our authorization, Microsoft will only store or process your data within a designated geographic location, in this case, Europe.

General data access

Our goal at Digitoo is the automation and digitization of accounting. Because accounting contains susceptible data, we handle it very carefully. Each approach is compliant with EU laws, including GDPR.

Data processing

We are constantly improving our data extraction algorithms. For this work, we must have a sufficient sample of accounting documents, which we use for training and gradual improvement. We use our users' documents for this learning for the duration of the Data Processing Agreement.

Secure code

During the development of our product, we follow OWASP recommendations. Each code is subject to peer review within the team. We use automated vulnerability detection tools and update our software regularly. Code quality is constantly checked by third-party tools. Our product is covered by unit and integration tests and is also manually tested.

In case of any questions, do not hesitate to contact us via email: support@digitoo.cz