Data security at Evity
How we protect your data
Authentication and access
Evity uses Microsoft's OAuth infrastructure for authentication and account management for individual users. This ensures that only authorized users can access their accounts, using a reliable and well-proven method for secure sign-in.
Encryption at rest and in transit
All data in Evity is encrypted both at rest and in transit. Data saved in Evity is stored in encrypted form in our database, and all documents uploaded to Evity are stored in encrypted form in a secure Microsoft storage account and can only be decrypted when handled within the Evity system. All traffic between Evity's web server and our customers' browsers is protected with TLS, which ensures that all transferred data is encrypted. This is especially important for sensitive information such as personal data. The encryption keys are platform-managed by Microsoft Azure and rotated by Azure.
Hosting and storage in Sweden
Evity is hosted on Microsoft Azure's infrastructure, recognized as a world leader in digital security and used by thousands of companies worldwide in industries such as banking and finance, technology and the public sector. Customer data is stored and processed within Sweden.
Backup
The system creates encrypted backups that are stored geo-redundantly in a separate Microsoft data center within Sweden, apart from the production environment. If the production environment were to stop working, the service can be restored from the backups. Backups are taken continuously throughout the day. The database can be restored to any point in time within the last 30 days. Weekly copies are kept for 3 months and monthly copies for 12 months, after which they expire automatically.
Access control in the development organization
To ensure strict security control within Evity's development organization, access to the development environment is granted on an as-needed basis, which minimizes the risk of internal security incidents. Teams working on different projects only have access to the data required for their specific project. Evity also uses a separate database for development work, which means that customer data cannot be accessed or edited from this database, and development teams do not have access to the production database. This protects customer data from being changed accidentally or incorrectly during the development process.
Report a vulnerability
Evity has an information security management system based on ISO/IEC 27001. If you discover a vulnerability in our services, please report it according to our vulnerability reporting policy or directly to security@evity.hr.