Data Protection & Security
We take the responsibility of data protection and security very seriously. For this reason, we have developed all of our systems from the ground-up with security foremost. We have put in place a code of practice to ensure integrity at all times and we have a regular programme in place for auditing data security and protection.
For a brief overview of our security and data protection procedures, please see the following video:
Our code of practice that governs how we secure our systems and protect sensitive data falls under 3 main categories:
- Data security
- System defences
- Certification
Further details on these three key areas are provided below.
1. Data security
Our code of practice for data security is based on the following key principles:
- Data is only stored when it is absolutely necessary to do so
- Data is only stored in a secure environment using industry-standard encryption techniques
- Data is never shared with any third-parties
- Data is transferred between storage locations only when it is absolutely necessary to do so
- All data that is transferred between storage locations is done so via a certified secure connection
- Only approved individuals who work for Pro Delivery Manager are given any access to the data, and only when their role dictates that this is absolutely necessary
These key principles are applied in the following ways.
Data Storage
Our latest audit has identified that the storage of sensitive data is limited to the following locations:
- Client databases hosted in UK data centre
- Mobile device memory (temporary)
- Computer system at software developer premises (temporary)
Further details regarding how and why data is stored at these locations is provided below.
Client databases hosted in UK data centre
In order to provide our order and delivery management service we need to store information about your delivery depots, your customers, your customer's orders and courier tracking data (location data) on a web server that is accessible over the Internet.
A separate database is created for each PDM account holder. The database of each account holder thus only contains information relating to their business and customers.
Each database is secured by a strong password. The password is only known by the website services that require access to the data.
The databases are hosted on dedicated servers at Memset, a UK-based data centre. Please see Memset's security policy for details on how these servers are maintained within a secure environment.
The web servers are maintained by our development team at IB Computing. Memset staff do not have access to the web server consoles. Only selected staff at IB Computing and their approved sub-contractors have access to the web server consoles. In addition to access control by user account authentication, access is restricted to IP addresses which are used only by IB Computing and their sub-contractors.
The web servers are protected from unauthorised access by the following technologies:
- Hardware firewall at Memset (includes Denial-of-Service attack detection and prevention)
- Software firewall on each server
- Anti-virus software
- Windows Server group policies
- Windows Server user authentication
Mobile device memory
In order to use the PDM app for managing deliveries when there is no Internet data connection available, customer, delivery depot, courier and scheduled delivery information is downloaded to the mobile device when the courier logs in.
All sensitive data downloaded by the app is stored in a temporary memory area. This means that when the user closes or logs out of the app this data is cleared from the memory storage area. No sensitive data is stored in the device's persistent memory area apart from updates to delivery data that is waiting to be synchronised back to the web server. As soon as any data is synchronised with the web server this data is cleared from the persistent memory area on the device.
All data transmitted is encrypted using an industry-standard encrypted format. The app source code is encrypted by a security certificate. The app is run in production mode so that it cannot be accessed via debugging tools.
Computer system at software developer premises
If one of our clients requests that we assist with importing their customer database to the PDM system, a member of our development team at IB Computing or their approved sub-contractors may temporarily store the data import file provided by our client on their computer system. Once the data has been successfully imported, however, such data import files are permanently deleted.
No other sensitive data is stored at IB Computing's premises or the premises of their sub-contractors.
Data Transmission
Our latest audit has identified that the transmission of sensitive data is limited to the following occasions:
- Transmission of data between the mobile app (PDM App) and web server
- Transmission of data between the PDM web application (PDM Web) and web server
- Relocation of databases between web servers
Transmission of data between the mobile app and web server
Data is transmitted over public networks. If the app is permitted to use a mobile data connection then data may be transmitted over the network of mobile carriers. Whatever networks are used for data transmission, data is kept secure at all times by using encryption as described below.
All data transferred between the mobile app and web server is encrypted using an industry-standard security certificate provided by AlphaSSL. The data is encrypted using a 2048-bit key.
Transmission of data between the web application and web server
Data is transmitted over public networks via the user's Internet Service Provider. Whatever networks are used for data transmission, data is kept secure at all times by using encryption as described below.
All data transferred between the online delivery manager website and web server is encrypted using an industry-standard security certificate provided by AlphaSSL. The data is encrypted using a 2048-bit key.
Relocation of databases between web servers
On occasion, it may become necessary to transfer a client's database to another web server. On such occasions, the work is carried out by qualified staff at IB Computing or their approved sub-contractors. Sensitive data is transferred directly between servers using a secure connection.
Access Control
Our latest audit has identified that access to sensitive data is controlled at the following points:
- Login to PDM Web/App by account users
- Login to web server consoles by staff at IB Computing or their approved sub-contractors
Further details regarding access control at these points are provided below.
Login to PDM Web/App by account users
When a user logs in, their login details are transmitted in encrypted format to the web server hosting the client's database. If the login credentials match a known user account a unique session key is generated and returned to the web browser. Future requests for data access made by the user to the web server are authenticated by the unique session key.
The user can log out of PDM Web or PDM App using the button provided for this purpose. The session key is cleared upon log out.
Login to web server consoles
Only selected staff at IB Computing have access to the web server consoles. In addition to access control by user account authentication, access is restricted to IP addresses which are used only by IB Computing or their sub-contractors.
Data Protection Governance
Pro Delivery Manager are registered with the Information Commissioner's Office for Data Protection purposes. Their registration number is ZA06570.
IB Computing are registered with the Information Commissioner's Office for Data Protection purposes. Their registration number is Z1207765.
Both Pro Delivery Manager and IB Computing have developed their data protection policies in line with the guidance provided by the ICO.
Each client that registers an account with Pro Delivery Manager should also be registered with the Information Commissioner's Office for Data Protection purposes. This is a requirement stated in our Terms and Conditions of Service. We expect our clients to use our services in line with the guidance provided by the ICO.
2. System defences
In 2021 we identified the need to add a dedicated security expert to our team to ensure that sufficient resources are allocated to care for the security of our infrastructure. This enables us to continue to identify new security threats, audit our systems for vulnerabilities and stay up to date with patches and mitigations.
We follow the OWASP "top 10" standard awareness document for developers and web application security. It represents a broad consensus about the most critical security risks to web applications.
In line with this, we are actively working to identify and remediate the following threats:
- Broken access control
- Cryptographic failures
- Injection
- Insecure design
- Security misconfiguration
- Vulnerable and outdated components
- Identification and authentication failures
- Software and data integrity failures
- Security logging and monitoring failures
- Server-side request forgery
Penetration testing
We use industry-approved software to scan our servers and network on a daily basis. These scans look for known vulnerabilities and weaknesses, including out-of-date applications and tooling. These reports are reviewed once each month by our dedicated security technician and steps are taken to resolve all issues detected. A monthly report is provided to stakeholders indicating the vulnerabilities detected and their remediation.
The same process is followed by all of our developers, scanning their workstations and networks for any known vulnerabilities and weaknesses.
3. Certification
