Hosting
# What is the hosting policy for the Service?
365Talents' hosting provider is subject to very high security and quality standards, see "Security" section.\
The Service and its data are hosted exclusively in the European Union, and 365Talents' hosting provider offers identical services on several sites in the European Union.
# Is the Service Provider's datacenter Tier 3 or higher?
Yes
# What is the financial capacity of the Service Provider?
Please refer to the "External service providers and subcontractors" page for further details.
# Where are the Service infrastructures located?
European Union (main datacenter: France; backup datacenter: Ireland).
# Who has access to customer data?
- 365Talents: its authorized personnel\
- Customer: staff with Service administrator account
# Is data isolated by customer?
Yes.
Please refer to the "Data processing" page for further details.
# Is the platform shared with other customers?
Yes.
Please refer to the "Data & Privacy" page for further details.
# Does the Hosting Provider have access to the Service data or infrastructure?
No.
The Service Hosting provider is not able to connect to the Service Infrastructure.\
The Service Hosting provider is not able to access the Service Data.
API interfaces
# Does the Service enable data exchanges with external applications?
Yes: via Electronic Data Interchange (EDI) and API.
# Are data exchanges secure?
Yes :
- Data sent by the customer to the Service via EDI is encrypted via SFTP. Authentication is authorized only after verification of a public/private key pair. Formats: flat files (CSV, PDF, etc.). Please refer to the "Input data connectors" tab for further details.\
- Data transfers via API are encrypted (HTTPS) and authorized only by exchange of a nominative API key (per Customer and application, supplied by 365Talents and revokable on request).
# In the case of a one-off or regular import of data, in what format should it be transmitted?
For data such as the list of employees with access to the application, the skills repository, the job repository, etc., please refer to the "Input Data Connectors" page.
Industrialization
# Are there service supervision tools?
Yes :
- 365Talents' hosting provider provides performance monitoring of the IT infrastructures used: resource monitoring (CPU / RAM load / hard disk I/O / network I/O).
- 365Talents monitors the health and performance of the Service using software probes.
- 365Talents has set up an automated alert service
Communication in the event of a detected problem:
- Automatic e-mail alerts to 365Talents' technical teams
- Automatic sending of instant messages to 365Talents' technical teams
# What are the supervision points?
- Supervision of IT infrastructures: CPU / RAM load / Hard disk I/O / Network I/O\
- Supervision of HTTP servers
- Database supervision
- Supervision of application servers
- Supervision of backup procedures: completeness of backup and replication processes
# Is data encrypted at rest?
Yes, via infrastructure-level encryption with encryption keys managed by the hosting provider.
# Is data encrypted in transit?
Yes, via TLS 1.2 and TLS 1.3.
The encryption suites used are :
- TLS_AES_256_GCM_SHA384 (TLSv1.3)
- TLS_AES_128_GCM_SHA256 (TLSv1.3)
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (TLSv1.2)
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (TLSv1.2)
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (TLSv1.2)
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (TLSv1.2)
\# Are backups encrypted?
Yes, with double encryption: encryption at rest (see above) + AES-256 encryption (keys managed by 365Talents).
# Does the Service have backup procedures?
Yes.
Backup mode:
- Frequency: every 4 hours
- Retention period: retention of 600 simultaneous backups (i.e. a 100-day history)
- Content: entire database and associated resources (e.g. images, attachments)
- Automatic monitoring of backups to ensure they are working properly, and automatic alert to 365Talents' technical team in the event of an error.
Backup data is stored by the hosting provider :
- on a virtual hard disk, triply replicated by the hosting provider.
- on a remote storage system operated by the hosting provider (Blob Storage), triple replicated and isolated from the production infrastructure.
# Does the Service have archiving procedures?
365Talents does not archive backups beyond 100 days.
# Does each user working on the Service authenticate with a personal nominative account?
- On access to the Service by the Customer's users: Yes, use of a nominative user account.
- On access to servers and data by 365Talents' technical team: Yes, each member of the technical team has a personal user account to carry out all actions linked to the servers and database storing the Customer's data.
- On the functionalities and upgrades of the Service by 365Talents' technical team: Yes, each upgrade or modification of functionality is traceable via a dedicated user account for each member of 365Talents' technical team.
# Are the actions carried out by a user on the Service infrastructures recorded?
Yes :
- Actions on 365Talents' infrastructures are recorded without condition or time limit;
- Connection traces on the 365Talents' infrastructures and on the Service are recorded for 1 year.
# Is Service deployment automated?
Yes :
- Initial deployment fully automated
- Fully automated update procedures
# How are Service configuration parameters managed?
Configuration information for each Customer is centralized on a version management system and used by automated deployment and update procedures.
# How is the source code of the Service managed?
The source code of the Service is stored on a decentralized version management system (git), access to which is strictly limited to 365Talents' technical staff. Each modification to the code is recorded, and includes in addition to a unique identifier: the timestamp, the identifier of the person responsible and an explanatory message.
Security
Physical security of the service infrastructure
# What certifications does 365Talents' hosting provider have?
365Talents' Hosting provider is certified ISO 27001:2013, ISO 270017:2015, ISO27018:2019, ISO27701:2019 and provides SOC 1 type II and SOC 2 type II reports.
# What measures are in place to address environmental factors?
- Several physically isolated data centers in different geographical areas\
- Fire detection and suppression systems, water detection systems
Security of the 365Talents' infrastructure
# Is the service protected against Distributed Denial of Service (DDoS) attacks?
Yes, as standard.
OSI layers supported: 3, 4, 7
# What procedures have been put in place to limit access to the Service or its infrastructure (firewall, etc.)?
Operated by the Host :
- The infrastructures operating the Service are protected by a firewall operated by the Hosting provider.
Operated by the Provider:
- The Service is protected by a firewall authorizing incoming connections only on ports 80 (HTTP), 443 (HTTPS) and 22 (SSH). All other incoming communications are ignored.
- Database and search engine applications refuse all connections outside the Supplier's infrastructure.
- Automatic ban after 6 unsuccessful SSH connection attempts within 10 minutes.
- Automatic banning after detection of automated scans (looking for scripts to execute, trying to access non-existent directories or files, etc.).
- Password-based SSH connections prohibited, mandatory key pair exchange
- Web applications running the Service are protected by a Web Application Firewall (WAF), which filters incoming requests according to the following criteria (non-exhaustive list): non-violation of HTTP protocol; HTTP DDoS protection (HTTP Flooding and Slow HTTP DoS attacks); rejection of access by robots, trojans and scanners; rejection of Cross-Site Scripting (XSS) attacks, rejection of SQL Injection attacks; rejection of Directory Traversal attacks; rejection of potential information leaks (including internal software version numbers).
- Mandatory use of HTTPS for service access, via HTTP Strict Transport Security (HSTS)
- Use of an anti-Cross-Site Request Forgery (CSRF, XSRF) mechanism for all requests involving the creation, modification or deletion of data, whether issued by Service Users or Administrators
# Are intrusion attempts recorded?
Yes :
- All bans following multiple SSH connections are logged, with no time limit. Logged information: timestamp, source IP address
- All requests blocked by the web application firewall are logged, with no time limit. Logged information: timestamp, unique identifier, complete content of blocked request, source IP address, destination IP address, reason for rejection.
# Is the Service protected by anti-virus software?
Yes: All files sent to the Service are scanned before being accepted and stored. This applies to all requests to send files, whether made by Service Users or Administrators.
# How often are security updates installed?
365Talents has implemented a policy of installation of security updates, delays go from 7 working days (Critical) to 120 working days (Low).
# Is the application account used by the application to connect to the database different from the default, secure account?
The application account used by the application to connect to the database is different from the default account, which is specific to each customer. In addition, passwords to access databases are randomly generated and are different from the default password. Access to our databases is closed to all external connections. The only possible connections are through our VPN.
Service security
# Is access to the Service restricted?
Yes, only to authenticated and authorized users.
Certain functionalities are restricted to certain user groups, such as Administrators, determined by the Customer.
# Does the application host server-type resources on the workstation?
No
# Are incoming connections to the workstation required?
No
# Does the application store processing data on the workstation?
No
# Does the application require special privileges on the user's workstation?
No
# Does the application require special privileges on the administrator's workstation (functional or technical) for its use?
No
# Does the software require additional content to run?
No
# How are users identified?
If a Single Sign-on (SSO) system is used: management of user connection to the Service is delegated to the customer's SSO. The customer's access security policy is then applied.
In the absence of an SSO system: user connection to the Service is managed by 365Talents.
The list of users authorized to access the Service, and their access rights, are then periodically transmitted to the Supplier by the Customer via secure, encrypted EDI file transfer, or via HTTPS-encrypted and authenticated API access (please refer to the "Input data connectors" page for further details).
Management of passwords used by users to access the Service:
- Passwords can be restricted in terms of number of characters and content: minimum number of lower-case letters, upper-case letters, numbers and special characters; possibility of restricting the password to be different from the user's surname, first name and user ID; possibility of preventing a password from being identical to N previous passwords; possibility of specifying a maximum password validity period to force each user to change his or her password after X days.
- Encryption by a one-way encryption algorithm before being stored in the database: bcrypt encryption function, Blowfish algorithm with random salt generation per user (protection against rainbow table attacks)
- Automatic banning: after 10 unsuccessful attempts within ten minutes.
Users can request a password reset via a dedicated form.
# Does the application allow authentication to an external repository (Active Directory, AD Azure or ADFS)?
Yes, to any repository supporting SAMLv2 or OpenID Connect.
# Which SSO protocols are supported by the Service?
Natively managed protocol: SAMLv2
Additional protocols available on request.
# Does each user have a unique identifier?
Yes.
# What mechanism is used to store user authentication information?
Cryptographically signed connection token ("JWT token"), transmitted via secure connection (HTTPS encrypted by TLS). No use of cookies for session storage or any other functionality.
365talents reserves the right to use cookies in the future that will be secured with the HTTP-ONLY and SECURE option.
# Does the application support a strong authentication method natively?
No
# Is a user session defined for a specific duration?
Yes: maximum 8 hours (configurable)
# Can generic administration accounts be deleted?
No. The Service does not offer the possibility of using generic administration accounts.
# How are Service administrator accounts defined?
User profiles with access to the Service are listed in the Service administration interface.
- Manual addition and deletion of users, via the Service administration interface, accessible only by Service Administrators, determined by the Customer;
- Automatic addition and deletion of users: via secure, encrypted Electronic Data Interchange (EDI), or via HTTPS-encrypted, authenticated API access.
# How granular are user rights?
Rights are defined per user. Access rights are managed by configurable rights profile. You can create as many rights profiles as you need.
- Default rights : Read and modify your own data;
- Granular rights: read, modify and delete data by a user on a pre-defined set of data or functions.
- Extended rights: reading, modification and deletion of data by a Service Administrator (determined by the customer) on all Service data.
# How are user rights applied?
All information relating to rights profiles is stored in a database table. Each user is associated with a right profile in another database table.
Technical control of logical access is systematically performed by the back-end software to prevent unauthorized read or write access.
# Does the Service enable the extraction of implemented authorizations?
Yes, authorized users can export their platform's user list directly from the platform. This export includes each user's login, rights profile and last connection (date and time).
# How are external systems authenticated?
- Every HTTPS request must be authenticated.
- File exchanges via EDI are encrypted (SSH) and authorized only after verification of public/private keys.
- Data transfers via APIs are encrypted (HTTPS) and authorized only by exchanging a nominative API key (per Customer and application, provided by 365Talents and revokable on request).
# What good development practices have been followed?
- Data storage in standard canonical form
- String encoding before display
- Validation of incoming data
- User data escaped before any query
- Parameters isolated from the query URL
- Use of ORM
- Server-side data validation
- No default password
- Passwords encrypted with a non-reversible method before storage
- Use of an encrypted communication channel (TLS only) for all communication
- Mandatory use of HTTPS for service access, via HTTP Strict Transport Security (HSTS)
- Time-limited user sessions
- Session deletion on logout
- Testing on pre-production infrastructure before going live
- Application log storage
- Automatic antivirus scanning of files before accepting and processing requests
- Use of an anti-Cross-Site Request Forgery (CSRF, XSRF) mechanism for all requests involving the creation, modification or deletion of data, whether issued by Users or Service Administrators.
In addition, we use testing methodologies such as PTES and OWASP in the application design and development phases. In fact, the system is free of the top 10 OWASP vulnerabilities.
Service data
# Are the Data stored on or produced by the Service classified by confidentiality level? Is there a Data classification system?
Yes: refer to the "GDPR, Data & Privacy" section.
# How are Personal Data produced or stored on the Service processed? What information should be submitted to the CNIL or the Correspondant Informatique et Libertés?
Refer to the "GDPR, Data & Privacy" page.
# Is there a Data reversibility plan?
Yes: please refer to the "GDPR, Data & Privacy" page.
# Is the Data stored on or produced by the Service isolated by Customer?
Yes: refer to the "GDPR, Data & Privacy" page.
# Can Data be exported?
Yes: refer to the "GDPR, Data & Privacy" page.
Supplier's internal organization
# Is there a CISO?
Matthieu Borrel, IT Security Manager.
# How are security incidents managed? What are the Supplier's commitment levels in terms of security?
The Customer's security contact is immediately informed.
Security incidents are given priority, and all ongoing developments and deployments are interrupted until they have been resolved.
365Talents commits, in the event of any major Vulnerability affecting the security of products and services coming to light, to:
- make available to the Customer, within one (1) working day of its detection, an impact analysis and a corrective plan, in agreement with the Customer;
- make available to the customer, within three (3) working days of its discovery, any workaround or workaround solution that does not alter the price or functionality of the products and services supplied under the Contract;
- to provide the Customer with a definitive solution to the problem within seven (7) working days of its discovery.
In the event of any new Vulnerability, other than a Major Vulnerability, being identified, 365Talents commits to:
- make available to the Customer within four (4) working days of the Vulnerability being identified any workaround or workaround solution which does not alter the price, performance or functionality criteria listed in the present contract;
- in the event of failure to provide the appropriate corrective measure within four (4) working days of the Vulnerability being identified, to provide the Customer with a definitive solution resolving the problem within eight (8) working days of the Vulnerability being identified, and undertakes to keep the Customer regularly informed of the progress of its actions;
- provide the Customer with or implement the appropriate patch as soon as it becomes available, or as soon as it is made available by the publisher and/or manufacturer.
# Are there procedures for managing 365Talents' administration accounts?
Only 365Talents' technical personnel have access to the technical infrastructures. Their access is strictly personal, regularly re-evaluated according to needs, and immediately withdrawn if they leave the company.
# What is the strategy applied to 365Talents' administration accounts?
- Nominative accounts used systematically
- Automatic banning after 6 unsuccessful login attempts within 10 minutes
- No generic user accounts on applications or servers
# Are 365Talents' technical teams trained in good security practices? Has the supplier set up a vulnerability management process?
365Talents' technical team subscribes to various IS security feeds and newsletters, including alerts issued by the ANSSI's CERT-FR (governmental center for monitoring, alert and response to computer attacks), the publishers of the software used, and news websites maintained by well-known people in the security community. These alerts are automatically fed into 365Talents' internal communication tool.
365Talents has implemented a policy of installation of security updates, delays go from 7 working days (Critical) to 120 working days (Low).
# Does 365Talents host or copy customer data from the Service off-site?
No.
# Does 365Talents print documents containing Customer data from the Service?
No.
# With the exception of 365Talents' Hosting provider and the Service Provider responsible for sending transactional emails, do any of the Supplier's Service Providers have access to Customer data from the Service?
No.
Service availability and customer support
# What are the procedures for updating the Service?
The Service is a SaaS service.
Each new feature is deployed and available by default to all customers who are informed of it, without interruption of the Service and at no extra cost. Customers do not need to carry out any update procedures.
# What are the technical requirements for accessing the Service?
Access to the Service via a web browser (see Web Browsers Support).
User interface supporting the following screen formats: computers, tablets, smartphones.
No constraints on operating system, plugins or applets.
# Are customer support procedures in place?
The support service consists of assisting the Customer by telephone or email. In this context, the Supplier undertakes to provide a Telephone or Electronic Assistance Service: from 9:00 am to 7:00 pm, Monday to Friday (excluding public holidays). This assistance covers Technical Support and Customer Support.
# What is the escalation procedure in the event of an incident?
In the event of an incident not resolved by Customer Support, Technical Support is contacted and takes charge of resolving the incident.
Once the incident has been identified and confirmed, Customer Support informs the customer and, in agreement with the customer, determines a criticality level and an estimated resolution time. If resolving the incident requires modifying the Service, good development practices (tests, pre-deployment in a certification environment, etc.) are followed.
Customer Support informs the customer of the resolution of the incident.
# What is 365Talents' Guaranteed Recovery Time (GRT) for the Service?
Critical incident: 2 working days
Major incident: 5 working days
# Has 365Talents set up a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP)?
Yes, see BCP, DRP and SLA page.
Auditability
# Is the service auditable?
A written questionnaire may be sent by the Customer, to which 365Talents will reply.
# Is 365Talents auditable?
365Talents' premises where the Service is managed and maintained are accessible on request for audit purposes.\
A written questionnaire may be sent by the Customer, to which 365Talents will respond.
Technical audits and intrusion tests may be carried out at any time during the Contract period.
A notice period of 20 working days prior to the audit is required in order to notify 365Talents' Hosting provider of the intrusion tests to be carried out on its infrastructure.
The following will be provided:
- an isolated, iso-production audit environment
- a test data set\
- user accounts with various access rights (user, manager, HR, etc.)
# Does the supplier have an audit report available?
A summary of an audit report dated 2021 is available on request.
# Can 365Talents' hosting provider be audited?
The customer may submit an audit questionnaire in writing, to which the Hosting Provider will respond. The Hosting provider, however, reserves the right not to reply to any question concerning industrial secrecy.
365Talents' Hosting provider does not authorize physical audits of its premises or datacenters.