Security and Privacy FAQ

Whether you are a prospect or a current customer, this FAQ will provide valuable insights into how we deal with Information Security and Privacy at Templafy, and address commonly asked questions about our application and organizational security measures.

Security / /

Application Security

Penetration testing is conducted to measure the security posture of Templafy Services and Infrastructure. Templafy has an external penetration test performed at least once per calendar year.

The objective of those penetration tests is to identify design or functionality issues in Templafy Services that could expose Data or Customers to risks from malicious activities.

Each external penetration test is performed by an internationally recognized, independent third-party software security testing company.

Each penetration test:

(i) encompasses both the internal and external network and authenticated application layer,

(ii) includes at least 80 hours of manual effort by the testing company,

(iii) probes for weaknesses in network perimeters or other infrastructure elements and any weaknesses in process or technical countermeasures relating to Templafy’s Services that could be exploited by a malicious party, and

(iv) identifies (at a minimum) the following security vulnerabilities: invalidated or unsanitized input; broken access control; broken authentication and session management; cross‐site scripting (XSS) flaws; buffer overflows; injection flaws; improper error handling; insecure storage; denial of service; insecure configuration management; proper use of SSL/TLS; proper use of encryption; and anti‐virus reliability and testing.

Customer-led penetration testing can be conducted upon request at security@templafy.com and is subject to conditions prior to carrying out the tests.

Vulnerability scanning is performed on a continuous basis by Templafy in accordance with the vulnerability management policy. Technologies used are:

  • WhiteHat Security scanning for 24/7 web application dynamic application security testing (DAST),
  • SonarCloud for static application security testing (SAST) before each release,
  • Software Composition Analysis 24/7. We scan the libraries and dependencies used in our products to identify vulnerabilities and ensure the vulnerabilities are managed.
  • Renovate for ensuring that open-source dependencies always are the latest available version.
  • Azure Security Center and Azure Monitor for daily infrastructure, network, and application vulnerability scanning. Retests and on-demand scans are performed on an as-needed basis.

Templafy’s software development practices across each of the engineering teams are aligned with the Secure Development Lifecycle (SDLC) methodology and follow Scrum and Agile approaches.

Detailed policies and processes for the development of the Templafy Services have been designed with optimal security and quality in mind.

The principles of security by design and default are implemented and rooted in training, coaching, pair programming, code review comments, coding tools, and branch policies in Azure DevOps.

Templafy has implemented segregated environments for development, testing, and production as a means to support the segregation of duties and prevent unauthorized changes to production.

In addition, production data is not used or copied to non-production environments. Test scripts and synthetic data are created for use in the development and stage environments.

All application code changes are tested, peer-reviewed, and approved prior to implementation into production. The production and non-production environments are deployed in their own Azure Active Directory and their own Azure Subscriptions, thus completely separated, and changes are tested according to the nature of the change in an environment separate from production prior to deployment into a production release.

Tests include functionality unit testing, integration testing, smoke tests, manual regression testing, and load testing. Extensive security testing is conducted (see vulnerability management section).


All change requests are logged, whether approved or rejected, on a standardized central system. The approval of all change requests and the results thereof are documented. Access to migrate change to production requires formal approval and is restricted to authorized personnel. Code management tools enforce branch protection policies to help ensure users cannot bypass standard change controls.


Backup 

For Templafy Services, tenant configuration data and binary data are backed up daily in SQL. In Templafy Hive, a 90-day Long-Term backup retention geo-redundant backup of SQL is available.

Data in storage accounts are written to three disks for redundancy per site and replicated across multiple sites.

The backup system automatically generates a backup log. A point-in-time restoration option is also enabled for up to 7 days, in which all changes can be restored with at most 10 minutes of data loss.

Access to backup data is restricted only to authorized personnel using Azure AD with multi-factor authentication.

Furthermore, all backups are encrypted using AES 256 encryption.

Backups are retained for 90 days in SQL. For blob storage, we have enabled soft-delete, so data will be removed 30 days after deletion.

The Templafy solution is hosted using Microsoft Azure PaaS.

Templafy uses multi-site data centers with availability commitments to permit the resumption of Templafy Services in the event of a disaster or partial outage at its primary data center location.


Business Continuity and Disaster Recovery

The Templafy platform is deployed redundantly in primary and secondary Azure data centers in respective Azure data regions.


Templafy has created Disaster Recovery plans to cover all three general scenarios: malicious incidents (third-party or insider threat), accidental incidents (human error), and unavailability incidents (Azure outages that affect our product). Templafy's business continuity plans are reviewed annually and updated, if necessary.

Templafy conducts testing of the business continuity and disaster recovery plans annually. Any issues identified during testing are resolved, and plans are updated accordingly. Testing of plans includes failing over a server and restoring backups.

  • The Recovery Time Objective (RTO) for the Templafy Platform is 24 hours.
  • The Recovery Point Objective (RPO) for the Templafy Platform is 24 hours


Data Security

Data is encrypted at rest using AES 256.

Data is encrypted in transit using minimum TLS 1.2.

The key management of Service-Managed keys for data at rest encryption is performed by Azure. The certificates used for data in transit encryption are managed using Azure Key Vault by Templafy and are subject to Templafy's cryptography policy.

Templafy is clustered into regions to provide enhanced availability, customers can select a region for data storage. Once selected, the data storage cannot be moved.

FunctionDescription
Public Cloud Service Provider Microsoft AzureOne
- North Europe (Primary) and West Europe (Secondary)

Hive
- West Europe (Primary) and North Europe (Secondary)
- East US (Primary) and West US (Secondary)
- Australia East (Primary) and Australia Southeast (Secondary)
- Central Canada
Infrastructure

Customer data is deleted from the platform 90 days after contract termination.


Identity and Access Management

Templafy supports just-in-time user-provisioning and SSO on-boarding against Azure AD, ADFS, SAML2, WS federation, Google Authentication (OAuth 2.0), and Azure AD (OpenID Connect).

Yes, please refer to this article on our Knowledge Base.

Yes, please refer to this article on our Knowledge Base.

Templafy offers activity logs to all customers. These logs include:

  • User management activity log
  • Space members' activity log (if spaces are used)
  • Library admin activity log
  • Email signature activity log

These logs are available in the admin center of the customer's tenant. To learn more about logs see here.


Incident Management

In the event of such a Security Incident, Templafy shall provide you with a detailed description of the Security Incident and the type of Personal Information concerned, unless otherwise prohibited by law or otherwise instructed by a law enforcement or supervisory authority.

Templafy shall without undue delay (and in any event within thirty-six (36) hours) inform the affected customer in writing, whenever Templafy reasonably believes that there has been an Information Security Incident.

Templafy shall inform the customer with as many details as known at that time (and regularly update the customer thereafter in writing or by email followed by a written notification) setting out in reasonable detail, without limitation, the nature of the information compromised, threatened, or potentially compromised, the specific information compromised or potentially compromised and of all events which may adversely affect the Vendor's ability to provide the Service.

Following such notification, Templafy will take reasonable steps to mitigate the effects of the Security Incident and to minimize any damage resulting from the Security Incident.

Templafy will assist and cooperate with affected customers with any necessary or appropriate disclosures and other investigative, remedial, and monitoring measures as a result of the security incident.

Incident report is handled as part of our incident management process, whereby incidents impacting customers are reported to respective customers.

For privacy-specific incidents, the process is governed by the DPA customers, and authorities are informed as required by the law.

Incidents can be reported through our Incident Reporting form or through our security@templafy.com email.

SLA: 99,5%

Please see here to monitor our uptime.


Organizational Security

Mandatory general security training is provided at onboarding to all employees and contractors. Mandatory training on a specific security topic is also provided annually.

The Information Security department at Templafy is managed by a CISO. The department includes members dedicated to the areas of Privacy, Governance, Risk, Compliance, and Technical Operations.

All employees undergo a background check prior to employment.

Please refer to this article on our Knowledge Base.


Physical Security

Templafy's service data is hosted in Microsoft Azure data centers. MS Azure adheres to security controls for ISO 27001, ISO 27018, SOC 1, SOC 2, SOC 3, FedRAMP, HITRUST, MTCS, IRAP, and ENS. Please refer to this link for more details.


The data center's physical infrastructure is operated by Azure and we rely on their data center security controls.

Access controls are implemented, including biometric controls, CCTV is active across the data center perimeters and access points are staffed with security officers.


Please refer to this link for more details on the physical security measures implemented in Microsoft Azure data centers. We monitor the compliance of these controls through independent security attestations and reports.

Templafy maintains a physical and environmental policy for its offices to ensure the security and integrity of Templafy’s facilities and the assets located within.


Templafy offices have industry-standard physical security protection with secure access, burglary alarm, motion detectors, etc.

Further visitors to secure areas are required to sign in and out with arrival and departure times, are required to wear an identification badge, and are always escorted while in secure areas.


Privacy

Personal Data Types

  • User profile information, such as name, email address, phone numbers, job title, and other elements as configured by customer admins. Can be read from customer ADs.
  • Any personal data in customer digital assets uploaded to the services, such as company pictures, contact information e.g. in contracts or slide decks, and any other elements in digital assets that customer admins choose to upload to Templafy
  • Any personal data inputted into response forms or relevant data sources, configured by customer admins.
  • System information such as IP address and usage behavior as users navigate through the Templafy services.

Templafy is typically used for standard, generic content such as contract templates and brand-compliant slide decks that users generate and further build on.

We mainly see user personal data in the form of work-related information and basic contact details, such as what an email signature would contain.

Templafy services can be used in many ways to optimize business contents, however from a privacy perspective, it is possible to restrict and govern the processing; the control is with appropriate customer admins.

Data Subjects

Templafy typically processes customer employee data, who are users of the services. However customer admins may choose to give access to partners or involve other data subjects should they wish.

About the Processing

Customer admins configure the authentication method by which customer end-users access Templafy with the use of their user profiles. Templafy processes end-users’ personal data set up in their user profile, any personal data included in the customer’s digital assets (e.g. company pictures), and if otherwise inputted in the services (e.g. data sources and response forms).

The authentication method may be just-in-time (JIT) user provisioning and single-sign-on onboarding against the customer’s active directory (AD), which can be configured to communicate to Templafy certain personal data elements (name, work email address, job title). End-users are able to view their user profile, and modify or delete to a degree controlled by the customer admin.

Data Processing Agreement

Yes. The Templafy data processing agreement (DPA) governs the processing of personal data that Templafy takes on as data processor, on behalf of customers as data controllers, unless otherwise agreed.

The Templafy DPA is compliant with applicable data protection legislation, including the General Data Protection Regulation (GDPR) and includes the necessary details about the processing of personal data specific to our services.

Sub-Processors

Templafy may use sub-processors, including affiliates of Templafy, as well as third-party companies, to provide, secure, or improve the services, and such sub-processors may have access to customer data.

Our list of sub-processors provides an up-to-date list of the names and locations of all sub-processors.

Processor or Controller

For the purpose of provisioning the Templafy services to our customers on the basis of performing the contracts we have with them, Templafy acts as a data processor.

For other purposes, Templafy may act as a data controller. These processing activities are described in the applicable privacy policies:

International Data Transfers

Yes. Please see our up-to-date status here.

Templafy Privacy keeps updated with regulatory restrictions and any changes to these. Once the Schrems II judgement required that the personal data protection in the European Economic Area (EEA) travelled with the data wherever it goes, Templafy verified that all third country transfers had legal basis for such transfer, including the use of the Standard Contractual Clauses (SSCs) and the performance of Transfer Impact Assessments (TIAs) on applicable jurisdictions to ensure appropriate supplementary safety measures were in place with the Templafy affiliates and third-party service providers.

As a result of the European Commission’s adoption of the adequacy decision for the EU-US Data Privacy Framework, Templafy certified under the framework to demonstrate reliable mechanisms for safe personal data transfer from the EU to the US.

Contact

Attn: Margrét Due
Head of Privacy
Wilders Plads 15A
1403 Copenhagen K
Denmark;
privacy@templafy.com

Law Enforcement Requests

Templafy can provide updated information relating to law enforcement requests for customer information upon request. As of 01/03/2024, we have received the following requests:

Type of RequestNumber of RequestsContent Data DisclosedNon-Content Data Disclosed
Subpoena000
Court Order000
Search Warrant000
Emergency Requests000
Law enforcement requests