Wellbeing Resources

See #43 and the following statement from our Hosting Provider: Data deletion on physical storage devices. If a disk drive used for storage suffers a hardware failure, it is securely erased or destroyed before Microsoft returns it to the manufacturer for replacement or repair. The data on the drive is completely overwritten to ensure that the data cannot be recovered by any means. When such devices are decommissioned, they are purged or destroyed according to NIST 800-88 Guidelines for Media Sanitation.

As per consent we do not purge all data. We use and store some data in a statically form. In the event of a business termination we purge PII within a week from the notice of termination has been effective. Backups are retained for 35 days. Customer information such as e-mails, invoices, meeting notes, contracts etc. may be stored longer.

Internally, yes 2FA is enabled for relevant staff/applications. Externally, it depends on your own configuration at your STS.

Internally, all access is controlled by Azure AD. External access (like the HR department of Grundfos or our response teams) my sign in with either 1) their own company credentials through Azure AD or own operated STS, or 2) a local Username/Password account (backed by Azure AD B2C).

No.

Yes, that’s a part of ISO27018. However please bear in mind that some data might transits out of EU. E.g. when sending e-mails, Text Messages or Push notifications. For that very same reason we will never send Personal Information nor Health Information through these channels.

Microsoft Azure using their European data centers.

We are a small development team, so segregation of duties can be difficult. However, we ensure that code entering production is peer-reviewed by at least one other team member of the development team. Also, only our CTO has privilege to release in our production environment.

Yearly.

https://wlbpubliccontent.blob.core.windows.net/public/E-bog%20dokumenter/WLB%20-%20Informationssikkerhedspolitik.pdf