A segurança na Factorial
Aqui na Factorial, estamos conscientes da confiança depositada em nós por mais de 3,000 empresas. É por isso que sabemos o quão importante é a segurança para eles.
Keeping our customers' data protected at all times is our highest priority. This security overview provides a high-level overview of the security practices put in place to achieve that objective. Have questions or feedback? Feel free to reach out to us at security@factorial.co Our security.txt can be accessed here
Cloud infrastructure
All of our services run in the cloud. We don’t host or run our own routers, load balancers, DNS servers, or physical servers. Our service is built on Amazon Web Services. They provide strong security measures to protect our infrastructure and are compliant with most certifications. You can read more about their practices here: AWS
Network level security monitoring and protection
- A virtual private cloud (VPC)
- A firewall that monitors and controls incoming and outgoing network traffic.
Data encryption
- Encryption in transit: All data sent to or from our infrastructure is encrypted in transit via industry best-practices using Transport Layer Security (TLS). You can see our report at SSLLABS
- Encryption at rest: All passwords are encrypted using battled-proofed encryption algorithms in the database.
Data retention and removal
- We retain your data for a period of 90 days after you close your account or request for removal. All data is then completely removed from the servers. Data will be remain on the backup 30 days after that.
- Every user can request the removal of usage data by contacting support.
- Read more about our privacy settings at https://factorialhr.es/en/privacy.
Business continuity and disaster recovery
Factorial backs up all the data on a daily basis and it retains the backups for 30 days. Hence, our RPO is 1 day. Is worth noticing that we have high availability with RDS Multi-AZ. This means that in order to have data loss we would need both availability zones to have an incident at the same time (an extremely unlikely scenario). If that were to happen, it’s very easy for us to recover a backup. Our RTO is 15 minutes.
Application security monitoring
- We use technologies to monitor exceptions, logs and detect anomalies in our applications.
- We collect and store logs to provide an audit trail of our applications activity.
- we use tools like https://semgrep.dev/ for static analysis to find bugs and enforce code standards.
- We use GitHub security tools to get alerts when a dependency has a vulnerability. The security team applies the security patches routinely.
- We run a yearly pentest backed by a third-party vendor. Our last pentest was done by https://cobalt.io/. We will happily share the results with you if you need them.
Secure development
- We review our code for security vulnerabilities
- We regularly update our dependencies and make sure none of them has known vulnerabilities
- We rely on yearly third-party security experts to perform penetration tests of our applications.
User protection
- We protect our users against data breaches by monitoring and blocking brute force attacks.
- Single sign-on (SSO) is available using Google, Microsoft and Linkedin account.
- Permission-based access control is offered on all our accounts and allows our users to define permissions.
- We use AWS Cognito, so by default we support multi-factor authentication.
Compliance
We’re compliant to the General Data Protection Regulation (GDPR). The purpose of GDPR is to protect the private information of EU citizens and give them more control over their personal data. Contact us for more details on how we comply to GDPR.
Payment information
- All payment instrument processing is safely outsourced to Stripe which is certified as a PCI Level 1 Service Provider. We don’t collect any payment information and are therefore not subject to PCI obligations.
Mais de 60,000 empresas já utilizaram o nosso software de recursos humanos
Nosso compromisso com a RGPD
Certificados e protocolos de segurança
Perguntas frequentes
-
Que fazem com os dados da minha empresa?Todos os dados recolhidos em Factorial nos ajudarão a agilizar e simplificar a gestão dos seus funcionários, melhorar a tomada de decisões e a reduzir os custos estruturais através da gestão de diferentes aspectos do trabalho da sua organização.
-
Partilharão os meus dados com terceiros?Não, a Factorial promete não vender nem transmitir os dados da sua empresa ou funcionários a terceiros.
-
Quem tem acesso aos meus dados?Toda as suas informações e documentos só são acessíveis com o seu nome de utilizador e palavra-passe. É muito importante que não partilhe esta informação com ninguém!
-
Posso eliminar os meus dados quando quiser?Sim, pode exercer qualquer direito de acesso, rectificação, cancelamento e oposição dos dados que tenha introduzido na Factorial em qualquer momento.
-
A Factorial pode assinar o meu formulário RGPD?Proteger os seus dados é a nossa principal preocupação. Consulte Política de Privacidade, Política de Cookies, Declaração de segurança de dados, Declaração Legal e também o Termos de Serviço para saber mais sobre o nosso compromisso e protocolo para proteger os seus dados em conformidade com a regulamentação RGPD para clientes da UE. Para além das informações descritas nestas páginas, não poderemos oferecer questionários estendidos ou assinar acordos pontuais com utilizadores individuais. Para qualquer dúvida adicional, entre em contacto connosco.
Portugal
-
Europa
-
América
España
France
Deutschland
United Kingdom
Italia
United States
México
Brasil
Argentina
Colombia
Chile