Skip to main content

Security overview

This document addresses on a high level different aspects related to Frosmo security and data integrity.

Physical security​

The Frosmo headquarters is located at:

Panimokatu 2 A, third floor
00580 Helsinki
Finland

The premises are equipped with security cameras and an alarm system. In addition, security personnel is constantly present at the premises during office hours and performs regular checks outside office hours. The premises can only be accessed with an electronic badge. The badges given to Frosmo employees are listed and controlled.

Customer meetings are mainly organized remotely. If and when a visitor arrives at the Frosmo office, a host lets the visitor in and accompanies the visitor throughout the visit. When necessary, secure meeting rooms can be booked at a separate space.

Cleaning services are provided by a dedicated cleaning company with a known person performing the cleaning at predefined times.

Server security​

Frosmo cooperates with the following GDPR-compliant platform hosting partners for back-end server hosting:

Customer data (data collected by the Frosmo Platform from our customers' websites) is backed up from production servers to a specific backup server hosted by Hetzner. For more information about the collected data, including the backups and server logs, see Data privacy description.

On the operating system level, servers and firewall settings are managed by Frosmo. Security updates are deployed constantly to keep all servers up to date with the latest security updates for data and access rights. The updates are deployed under the supervision of Frosmo's Chief Technology Officer (CTO).

The agreement with the hosting partners does not include access to operations related to Frosmo customer data. Frosmo personnel is solely responsible for managing all data collected by the Frosmo Platform.

By default, the Frosmo JavaScript library files are delivered through Amazon CloudFront. For more information, see Amazon's service-level agreement and product documentation. Frosmo can also use other services based on customer requirements.

Frosmo follows the best practices for managing AWS access keys. All JavaScript updates are deployed through automated processes, with each process using its own specific key with limited access.

Operational security​

The operational tools used at Frosmo can only be accessed over an HTTPS (HTTP Secure) connection. Access to the tools is always protected with credentials. The core operations personnel may use superuser access to manage services. Superuser credentials cannot be created using the normal operational tools. Credentials generated using the normal operations tools are always for a lower access level and can be shared with customer representatives. Customers can only generate and manage credentials of the same level for other users in their own organization.

Frosmo's System Administrator is responsible for all system updates. All changes and updates to Frosmo products in the production environment are carried out by the Frosmo Product team according to a predefined, mostly automated process that includes checkpoints and reviews. All software changes are carried out through a version control system (GitLab) and tracked in changelogs.

The Frosmo production servers can only be accessed by using public key authentication (administrative access). Public keys are provisioned based on predefined user roles. All granted keys are recorded by the System Administrator and deployed to servers using an automatic deployment process that adds, removes, and updates the keys on the production servers. All generated keys must follow the documented security guidelines, and are always personal and protected by a passphrase known only to the key owner.

The data on Frosmo servers is backed up regularly. These backups are replicated to secondary servers to provide recovery in case the primary server fails.

All operational networks are protected by firewalls and managed by designated employees. Critical system passwords are renewed on a regular basis.

The workstations used by Frosmo employees are always password-protected. Frosmo follows password encryption best practices. All workstations have antivirus and malware protection software as well as remote monitoring and management software in use. Files and documents are mainly stored in protected cloud-based services, such as Google Drive and Atlassian Confluence.

Disaster recovery and business continuity​

In case of a natural or human-made disaster, or a critical software or hardware failure, Frosmo ensures recovery and continuation of service through, for example:

  • Cloud computing. Frosmo uses Amazon Web Services (AWS), Atlassian Confluence, and Google Workspace, each a trusted cloud computing platform, for storing and/or serving data.

  • Data replication. To ensure the availability of data, Frosmo replicates operational data to backup servers in multiple physical locations.

The Frosmo headquarters is located in one of the most politically, socioeconomically, and infrastructurally stable countries in the world, Finland. The region is also one of the safest from natural disasters. Disruptions of service due to natural or human-made disasters are thus highly unlikely.

Personnel security​

The Frosmo work contract contains non-compete, confidentiality, and non-disclosure clauses. Additional non-disclosure agreements can be created for specific customers on request.

All new Frosmo employees are informed about physical and data security. The company organizes data privacy and protection training to all employees annually.

The requirements and conditions for each customer are always discussed within the team when a new customer project starts. Frosmo employees working with a specific customer can be disclosed to the customer on request. Customers can request a background check on Frosmo employees.

Frosmo employees are encouraged to observe and report to their supervisors all issues (on any level of operations) that are likely to compromise customer data security.

After an employee leaves Frosmo, the employee's access rights are promptly removed. This procedure covers physical access, data access, and any generated authentication keys.

Application security​

Access to the Frosmo Control Panel, the user interface for administering and monitoring sites in the Frosmo Platform, can be restricted based on IP address, so that users can only log in from Frosmo premises (or through a secure VPN connection) or from specific IP addresses defined by the customer.

In addition, the Control Panel triggers a warning if an account is accessed from multiple computers, and allows the user to close redundant connections. Too many failed login attempts trigger a failure mode, which forces additional authentication checks for subsequent login attempts and notifies the System Administrator.

Data security​

The Frosmo JavaScript library collects usage data in the visitor's browser and sends the data to the Frosmo back end over an HTTPS connection. The Frosmo JavaScript library also stores selected data locally in the visitor's browser.

Frosmo is committed to protecting the security of the visitors' personal data and has a variety of security technologies and procedures in place to prevent unauthorized access, use, or disclosure of data.

By default, the Frosmo Platform collects and processes only anonymous and pseudonymous information about visitors and their behavior on a website. The purpose and lawfulness of data processing is invariably determined by the customer and documented in the subscription agreement between Frosmo and the customer, in Frosmo Data Processing Annex, and in Frosmo General Terms of Service.

Customer data is always stored in such a way that the data of one customer cannot be mixed with the data of another customer. All software modifications can be tracked in changelogs and through the version control system (GitLab).

For more information about how Frosmo handles data protection and privacy, see Data privacy description.