ToolsGroup ensures, with the support of Azure’s capabilities, that each Customer’s data is redundant at multiple levels. Any data stored in the Solution is maintained with multiple redundant copies in the Primary Region, as well as Geo Replicated asynchronously to a Secondary Region.

ToolsGroup guarantees the availability and continuity of the service and backs this with service level agreements (SLA). A Recovery Point Objective (RPO) and Recovery Time Objective (RTO) of 24 Hours come standard with any plan.

The Customer is the exclusive owner of the Customer Data present in the Solution and is responsible for Data Classification and Governance. ToolsGroup Operators will have access to Customer Data only for purposes compatible with providing the contracted services. These may include troubleshooting aimed at improving features, assisting the Customer with specific requests, or preventing, detecting or repairing problems affecting the operation of the Solution.

Subcontractors can access and use customer data only to deliver the services they were hired to provide. ToolsGroup discloses the names of subcontractors who have access to customer data and provides advance notice of new subcontractors. All data transmitted from the Solution is encrypted in transit using Transport Level Security (TLS). 

The list of ciphers and protocols is constantly monitored as part of a Vulnerability Management process to ensure that they meet or exceed industry standards and are not affected by any known vulnerabilities.

The Solution is sized in standard tiers (small, medium, large) to support the most common deployment scenarios. The Solution can be scaled further beyond those standard tiers based on Customer requirements. The scaling process typically requires a short maintenance window and can be performed off-hours to limit any business impact.

ToolsGroup Operators working on the systems supporting the Solution are working from secured locations, connecting with TLS to the systems and using Multi Factor Authentication (MFA) for all sensitive operations. All ToolsGroup Workstations are using Full Disk Encryption and have no access to Customer Data.

ToolsGroup maintains up-to-date plans to manage the most common scenarios that can affect business continuity. These plans are tested yearly or more frequently if required by any significant change to the affected process and audited yearly as part of ToolsGroup’s ISO 27001 certification process.

To support this, and provide resiliency to the Solution, ToolsGroup provides business continuity in the following ways:

• High availability for the underlying infrastructure and components.
• Disaster Recovery in a secondary region.
• Frequent Backups with multiple redundant copies.
• Comprehensive monitoring to detect anomalies and events relating to outages and other events that may require immediate action. The monitoring system collects data from all systems that compose the Solution and can also issue alerts related to hardware and network capacity as well as security events and attacks.

ToolsGroup maintains policies and procedures to detect, manage and track any security incidents or events. The primary aim is the prompt detection of any incident or potential incident to reduce the risk of information exposure and to promptly communicate any breaches to all affected Parties and Authorities in the shortest time frame possible.

To support this process ToolsGroup has implemented:

• A security incident response plan that clearly defines tasks and activities that need to be carried out to properly evaluate, classify, mitigate and respond to security incidents.
• The definition of security-related roles and responsibilities within the organization, including the role of Information Security Manager and an oversight committee.
• Processes aimed at the continuous improvement of security-related aspects in the Organization that include the period review of existing measures and their effectiveness.

Compliance plays a critical role in providing assurance for Customers and in securing and bolstering the trust between the Customer and ToolsGroup. ToolsGroup maintains compliance with both local regulations as well as International Standards widely recognized in the industry.