Data Privacy
Can my reseller see any of my information?
Unless explicitly granted permission, resellers cannot access a customer's information. Some customers give their reseller support access as a managed service offering. Customers always have the control to revoke access for anyone at any time.
Can anyone see the content of my documents?
Nobody can see the content of your documents. We only keep them as long as needed. We delete them once we process them and deliver them to their final destination.
Who owns my data?
You are the owner of the data. All data which comes from you to our system are yours.
Who can access my data?
You can decide who will see the information about your company. Admin rights can be assigned to specific users within your organisation. You can also provide admin rights to your service provider through the Support Partner option. Once you grant the Support partner rights to a company, they can manage your company. You have complete control over whether to turn access on or off.
OptimiDoc Cloud staff can access your company data in case of need:
-
Legal Requirements
-
Support requests
-
System issues and bug resolution
If such access is needed, it's limited only to selected people and is prohibited except in the above circumstances.
Is my data encrypted?
All data transmitted between OptimiDoc Cloud components and customer infrastructure use TLS to encrypt all data in transit (TLS 1.2+ is used).
Microsoft Azure encrypts data stored in the OptimiDoc Cloud datacenter.
How is my data separated from other OptimiDoc Cloud customers' data?
Each company in OptimiDoc Cloud has a unique Identification Code assigned. All requests to OptimiDoc Cloud Datacentre must have a present ID next to other appliance info. Otherwise, the request is rejected. Additionally, all appliances need to be enabled by the administrator after registration to OptimiDoc Cloud.
Next to the ID, every customer has also been assigned an encryption key to encrypt sensitive information, including stored documents or OAuth tokens, to access customers' cloud storage. Encryption keys are securely stored in key vault restricted access, except for the OptimiDoc Cloud application.
Architecture & Infrastructure
Where is OptimiDoc Cloud hosted?
OptimCapture Cloud Services are hosted in Microsoft Azure. Security is one of the critical factors for Microsoft, which is why we decided on it. For more information, check the Microsoft web: Azure Security | Microsoft Azure
Where is that data centre located?
We provide different data centres to fulfil the local legislation requirements.
Is the infrastructure secured?
We are running a complete infrastructure in the Microsoft Azure environment. Microsoft handles the physical security; the application-level security is actively monitored for security events by OptimiDoc using Microsoft Cloud Defender.
Who has access to data centres?
Only authorised OptimiDoc employees have access to the cloud infrastructure and the ability to deploy code changes. MFA (Multi-Factor Authentication) is a requirement for all OptimiDoc employees and is enforced on all cloud infrastructure access.
Is physical protection anticipated and designed with countermeasures applied?
OptimiDoc Cloud uses Microsoft Azure. Microsoft strategically selects data centre locations to minimise the risks.
Does OptimiDoc Cloud have backups?
Yes, OptimiDoc performs daily backups.
What is the location of the data centre?
OptimiDoc Cloud has multiple data centres available for customers, which is necessary to fulfil the legal conditions.
Current locations are listed here: Geolocations of Datacentres
Where is the support and administration team located?
The support and Administration team of OptimiDoc Cloud is located in the Czech Republic. Document and data are not transferred between the particular data centres or other locations.
Security
Have any penetration tests and code security been done over the OptimiDoc Cloud?
Yes, we are performing automatic penetration tests over OptimiDoc Cloud. Code security/quality tools analyse every code change.
Do you have the ability to segment or encrypt customer data for specific customers logically?
All customer data is logically separated from other customers, and separate encryption keys encrypt sensitive data.
How is access to my cloud storage handled?
OptimiDoc Cloud uses the OAuth technology to authorise customer cloud storage access. Users' access and refresh tokens are kept in encrypted form inside the database. Users can easily revoke their access from the OptimiDoc Cloud Workplace web interface.
TLS encrypts the complete communication between OptimiDoc Cloud and Cloud Storage.
Is OptimiDoc ISO 27001 certified?
Yes, OptimiDoc is ISO 9001 and 27001 certified.
How can I get more info?
Whenever you need more security information, please get in touch with our support at https://support.optimidoc.com.