ParentMail Systems Security
At ParentMail we employ sophisticated technology with strict control processes to protect our systems. This ensures we can keep pupil, personal and financial data safe.
Our systems are hosted in secure data centres which are certified to ISO/IEC 27001:2005 – the international standard for information security management. This standard is designed to ensure the selection of adequate and proportionate security controls that protect information assets and give confidence to ParentMail users/integration partners
ParentMail uses a range of security measures for our systems. These include:
- Physical access restrictions
- Managed firewalls
- Regular threat assessment & mitigation
- Encryption & security tokens
- Anti-virus protection
- System & configuration monitoring
- Intrusion prevention & detection
- Locked down high level access
- Logging and analysis
Access controls and privileges
ParentMail uses strict access controls to determine what data can be accessed by individual users. Every user account is set up with a specific role which has a number of privileges. The privileges determine what data users can see, what they can modify and which features they can use.
Information is stored in our Database systems which are hosted within the EU (specifically the UK). We do not store sensitive data on “Cloud” based servers – all data is stored on dedicated secure hardware.
Security Methods and Password Storage
Our methods for securing data are, by necessity, of a private nature (publishing these methods would be a breach of security). We can reveal the general areas that are utilised in securing pupil, personal & financial data. These include :
- Public access secured by : RSA2048/SHA384(RSA) Certificate/Key Exchange with a trusted root authority
- SALTing of sensitive data
- Passwords are secured using a one way hashing algorithm. Passwords are then re-hashed thousands of times using salts unique to each user.