Safeguards for Customer Data Transfers

ActiveOps Cloud Products – description of transfers
The following is a summary description of the transfers between our customers (data controllers) and ActiveOps (data processor). All of the processing descriptions used may be comprised in the underlying commercial agreement including any supporting data processing agreement for the purposes of the Controller to Processor Transfer.

Technical and Organisational Measures to ensure the security of the data

ActiveOps reserves the right to update its security program from time to time; provided, however, any update will not materially reduce the overall protections set forth in this document.

1. Information Security Program and Team: The ActiveOps security program includes documented policies and standards of administrative, technical, physical and organisational safeguards, which govern the handling of Service data in compliance with applicable law. The security program is designed to protect the confidentiality and integrity of Service data, appropriate to the nature, scope, context and purposes of processing and the risks involved in the processing for the data subjects. ActiveOps maintains a globally distributed technical support team available during the service level agreement terms agreed in the contract to respond to security alerts and events.
2. Security Certifications: ActiveOps holds the following security-related certifications from independent third-party auditors: SOC 2 Type II, and ISO 27001:2022 (using ISO 27701:2019 as a Data Processor as a source for controls).
3. Physical Access Controls: ActiveOps takes reasonable measures, such as physical access control in office locations, to prevent unauthorised persons from gaining physical access to service data and attest third parties operating data centres on our behalf are adhering to such controls.
4. System Access Controls: ActiveOps takes reasonable measures to prevent service data from being used without authorization. These controls vary based on the nature of the processing undertaken and may include, among other controls, authentication via passwords and/or two-factor authentication, documented authorization processes, documented change management processes and/or, logging of access on several levels.
5. Data Access Controls: ActiveOps takes reasonable measures to ensure service data is accessible and manageable only by properly authorised staff, ensuring access rights are established and enforced to ensure that persons provisioning service and support only have access to the service data to which they have privilege of access.
6. Transmission Controls: ActiveOps takes reasonable measures to ensure the ability to check and establish which entities the transfer of service data by means of data transmission facilities is envisaged so service data cannot be read, copied, modified or removed without authorisation during electronic transmission or transport. Service data is encrypted in transit over public networks when communicating with ActiveOps user interfaces (UIs) and application programming interface (APIs) via industry standard HTTPS/TLS (TLS 1.2 or higher) or when transferring data feed files to ActiveOps services using SFTP (AES-256). Service data is encrypted at rest by ActiveOps’s Sub-processor and data centre services provider, Microsoft Inc., via AES-256.
7. Input Controls: ActiveOps takes reasonable measures to provide the ability to check and establish whether and by whom service data has been entered into data processing systems, modified or removed; and, any transfer of service data to a third-party service provider is made via a secure transmission.
8. Logical Separation: Data from different ActiveOps’s customer environments is logically segregated on systems managed by ActiveOps to ensure that service data that is collected by different data controllers is segregated from one another.
9. No Backdoors: ActiveOps has not built any backdoors or other methods into its services to allow government authorities to circumvent its security measures to gain access to service data.
10. Data Centre Architecture and Security: ActiveOps hosts service data primarily in Microsoft Azure data centres that have been certified as ISO 27001 and SOC2 compliant. Microsoft Azure infrastructure services include backup power, HVAC systems, and fire suppression equipment to help protect servers and ultimately your data. Microsoft Azure on-site security includes a number of features, such as, security guards, fencing, securing feeds, intrusion detection technology, and other security measures. More details on Microsoft Azure controls can be found at: https://docs.microsoft.com/en-us/compliance/assurance/assurance-datacenter-securityNetwork Architecture and Security: ActiveOps systems are housed in zones to commensurate with their security, depending on function, information classification, and risk. Our network security architecture ensures complete segregation between production, test and development as well as other supporting systems.
11. ActiveOps utilises network security scanning tools to identify potentially vulnerable systems.
12. Testing, Monitoring, and Logging: ActiveOps employs third-party security experts to perform continuous security testing which includes web application penetration testing and vulnerability scanning against test environments on its production infrastructure. ActiveOps centralises logs from important network devices and host systems and has deployed tools to monitor suspicious and unusual behaviour on it networks. Events are monitored by the Infrastructure team for investigation and response. Service availability is monitored 24/7 and action taken by the Infrastructure team on events which may impact service.
13. Data Hosting Location: ActiveOps offers customers environments are hosted in Microsoft Azure data centres, each paired for data resiliency with a recovery data centre in the same geography. Customers can select the data centre pairing within their geography or any other available data centre pairing.
14. Availability and Continuity: All customer databases are maintained in a high-availability database environment. Business continuity is assured through active geo-replication which creates readable secondary databases of individual databases on a SQL Database server in a second data centre. The fully resilient virtualised cloud platform includes all production and non-production environments to facilitate all functional and non-functional testing. The platform leverages enterprise-grade technologies from well-established and trusted industry leaders. Our strict backup regime and disaster recover approach allows us to deliver a high level of service availability, as agreed in contract terms.
15. People Security: ActiveOps performs pre-employment screening background checks of all employees, in accordance with applicable local laws. Employees receive information security and data protection awareness training during induction and annually thereafter. Employees are bound by written confidentiality agreements to maintain the confidentiality of data.
16. Vendor Management: ActiveOps uses a small number of third-party vendors to provide certain aspects of the Services. ActiveOps completes vendor security risk assessment of prospective vendors.

ActiveOps Sub-processors 

ActiveOps uses certain sub-processors (including ActiveOps affiliates and third parties, as listed below) to assist it in providing the ActiveOps Services as described in the Customer Contract in relation to our products ControliQ, CaseworkiQ and WorkiQ. Defined terms used herein shall have the same meaning as defined in Customer Contracts. 

We have updated this policy. As an existing customer, we are providing you with prior notice of these changes and should we not hear from you in writing within thirty (30) days from this notice we shall proceed on the basis that we have your consent to conclude the changes to sub-processors for the provision of services. For new customers, this updated policy is effective from March 9th, 2021. 

What is a Sub-processor? 

A sub-processor is a third-party data processor engaged by ActiveOps, including entities from within the ActiveOps Group, who has or potentially will have access to or process Service Data (which may contain Personal Data). ActiveOps engages different types of sub-processors to perform various functions as explained in the tables below. 

Due Diligence 

ActiveOps undertakes to use a commercially reasonable selection process by which it evaluates the security, privacy and confidentiality practices of proposed sub-processors that will or may have access to or otherwise process Service Data. 

Contractual Safeguards 

ActiveOps generally requires its sub-processors to satisfy equivalent obligations as those required from ActiveOps (as a Data Processor) as set out in Customer Contracts and associated Data Processing Agreement (“DPA”). ActiveOps information security and data protections controls are ISO27001 certified (including using ISO27701 as a source for Data Processor data protection controls) and our key sub-processors are ISO27001 and/or SOC2 Type II audited. 

Process to Engage New Sub-processors 

Customers who have executed a DPA or Contract incorporating similar terms, will be provided notice via this policy of updates to the list of sub-processors that are used by ActiveOps or which ActiveOps proposes to use to deliver its Services. ActiveOps regularly updates this list to enable its Customers to stay informed of the scope of sub-processing associated with the Services. Customers may subscribe through their assigned ActiveOps Relationship Manager or ActiveOps Customer Support to receive notifications of updates to this policy. 

Those Customers who have entered into a DPA or Contract incorporating similar terms, may object in writing to the processing of its Personal Data by a new sub-processor within thirty 

(30) days following the update of this policy and such objection shall describe the Customer’s legitimate reason(s) for objection on data protection grounds. Customers should refer to the relevant terms in their DPA or Contract where they plan to object to use of any new sub-processors and the remedies available to ActiveOps to address that objection. If a Customer does not object during such time period, the new sub-processor(s) shall be deemed accepted. 

The following is an up-to-date list (as of the date of this policy) of the names, roles and locations of ActiveOps sub-processors used for its Services (including affiliates of the ActiveOps Group and third parties): 

ActiveOps Affiliate Sub-processors (Processor to Processor Relationship) 

The following entities are members of the ActiveOps Group. Accordingly, they function as sub-processors to provide the Services to our Customers which includes provision of global customer service, business support and technical support for ActiveOps products. Standard Contractual Clauses are implemented between each subsidiary and ActiveOps PLC. 

Key Third Party Sub-processors 

² ControliQ Data Centre Primary/Secondary pairings: India: Mumbai, Pune; South Africa: Johannesburg, Cape Town; UK: London, Cardiff; USA: Virginia, California; Canada: Toronto, Quebec

Other Supporting Third-Party Sub-processors 

Update History