Tresorit’s Security Measures for Company Personal Data explains how Tresorit protects the personal data entrusted to it by customers and how these measures support compliance with Article 32 of the GDPR. It covers Tresorit’s ISO/IEC 27001:2022 certification, audited annually by TÜV Rheinland, as well as employee screening and mandatory security training. It also outlines physical and logical access controls, logging and traceability, encryption in transit, risk assessments, incident and data breach response, and business continuity planning. A final section explains how Tresorit vets third-party suppliers and how customer data is stored in Microsoft Azure data centers.
Key points:
- Certified: ISO/IEC 27001 certified since 2018, recertified to the 2022 standard, and audited annually by TÜV Rheinland.
- People and policies: Background checks, mandatory annual security and privacy training, phishing tests, and a dedicated Data Protection Officer.
- Access control: Need-to-know access rights, mandatory two-factor authentication, encrypted devices, and logical separation of customer data.
- Traceability: Key system activity is logged for individual users, and all data is encrypted in transit.
- Preparedness: Annual risk assessments, a documented incident and data breach response plan, regularly tested business continuity and recovery plans, and a public incident history.
- Trusted infrastructure: Security-vetted suppliers and customer data hosted in Microsoft Azure data centers.