In today's complex and regulated environment, our users rely on us to protect their data using tools and practices that meet industry standards. This page provides an overview of Netatoo's efforts to meet these requirements.

First, we secure our persistence layer by limiting access to our primary application database to the application layer and a fixed set of known Netatoo IP addresses. This access limitation is achieved through a combination of firewall rules, authentication mechanisms (requiring users to prove their identity) and authorization through role-based permissions.

We address the possibility of catastrophic loss of application data (e.g. as a result of a natural disaster) by automatically creating database backups with a geo-redundant approach. 

To help us maintain regulatory compliance, understand database activity and better understand discrepancies and anomalies that could indicate suspected security breaches (another aspect of the GDPR), we deployed an advanced threat detection audit on our servers. These services detect potential threats as they occur (e.g. abnormal database connections, SQL injection vulnerabilities) and immediately alert our team so they can take the necessary action. In the particular case of the GDPR, this service is a key element of the technical machine that enables us to detect data breaches and notify the supervisory authorities in the unlikely event that such a situation should occur.

At the application layer, we force all incoming requests to use secure HTTPS connections (HTTP over TLS). Depending on the client device, the connection may use TLS 1.0, TLS 1.1.1 or TLS 1.2. We prohibit connections using outdated and vulnerable SSL 2 and SSL 3 protocols. 

Accepted TLS connections are encrypted using an SSL certificate using the strongest web standard. As part of all HTTPS responses, our servers include a number of advanced security headers. These include in particular:

Netatoo receives an "A" rating from the independent securityheaders.io service to verify the various elements implemented. You can run the on-demand test for ballejaune.com and openresa.com and view the report for yourself. We also encourage you to compare the test to other websites that you use or intend to use.

Netatoo application hosting servers also receive an "A+" rating from the industry standard Qualys SSL Labs independent server test. You can run the test on demand and view the report yourself. The report notes that we are not vulnerable to some of the most recent vulnerabilities such as BEAST, POODLE and Heartbleed. Again, we encourage you to compare the test to other websites that you use or intend to use.

To help prevent brute-force attacks, our login mechanism also uses the account lock feature if an incorrect login password is entered multiple times.

Cookies sent by the server to the client for authentication and verification purposes are always marked with the "HttpOnly" and "Secure" attributes, and their domain and path values are set appropriately for use with ballejaune.com / openresa.com.

For online payments, Netatoo is PCI compliant. In practice, all payments are processed directly with the payment gateway you have chosen (PayPal, Paybox Verifone). As such, no sensitive payment details come into contact with Netatoo-owned systems (instead, it is transparently redirected to your gateway and then managed through a token-based approach).

Transactional emails sent by our services use the latest security features for email validation. These include the valid policies of the SPF, DKIM and DMARC. In the case of DMARC, our published policy requires recipients' servers to quarantine all messages that do not pass DMARC testing. These features are advanced tools that help prevent spamming, spoofing and phishing attacks. Of course, we also include unsubscribe links on all emails we send, and we have implemented a speed limit system to help prevent email bombardment attacks.

At the organizational level, Netatoo employees have limited access to data on "need-to-know" and "lesser privilege" security principles. Development and test systems are deployed on an internal network that is not accessible from the outside. The application source code is managed in a private repository and contains no sensitive information (such as API keys, passwords or connection strings).

In case of incidents (e.g. application failures, degraded performance or other), you can track the status of our services via Pingdom at the following address: http://stats.pingdom.com/rn0d9ch52vnj/1678478 

Finally, we pay particular attention to regularly update our servers and internal systems in order to bring the last security patches. We change our passwords every 60 days and use double-factor authentication on almost all third-party applications and services we use in our business.

We hope this information has helped you understand the key security mechanisms Netatoo has in place to secure your data. We continually review our security procedures, so that this information may well change in the future as we respond to the evolving security landscape. 

If you have any questions or require further information, please contact us by one of the following means:

Postal address :
​Netatoo SAS
BP 43606
54016 NANCY CEDEX
FRANCE

Email :
​support@ballejaune.com