Security and cybersecurity
Security by design – not bolted on afterwards
At netPension®, security is part of the architecture. This page answers the questions a pension institution has to clarify before making a decision – in the order in which they are asked.
Three principles
What this means in operation.
01
The data stays on the server
Processing and storage take place exclusively on the server. The workstation only displays the interface – no data remains on your employees' computers, not even when working from home. There is no client software and no local database.
02
Encrypted and in Germany
Your data is appropriately encrypted in transit and at rest. In cloud operation, it is stored exclusively in a data centre in Germany. No transfer to third countries.
03
AI without personal data
Artificial intelligence supports development and adaptation – exclusively in internal processes and without personal data on third-party servers. Your data is not training material, and no AI makes decisions in the live specialist procedure.
Cybersecurity
Eight questions that come before every decision.
We clarify these points with every pension institution and every pension fund – in cloud operation as well as when operated in-house. What is written here is the short version; the documented long version is the security concept.
1. Where is our data processed?
In cloud operation, exclusively in a data centre in Germany, with no transfer to third countries. When operated in-house, in your data centre – where the data does not leave your infrastructure.
2. Who can access the data?
Your authorised staff via the role and permissions concept of the application. In addition, our development team within the scope of data processing on your behalf, insofar as this is required for operation and support. The data centre operator provides the infrastructure and does not process any content.
3. Is access logged?
Yes. Access and changes are logged; history tracking records which version applied when and who set it. For sensitive processes, a four-eyes principle can also be set up.
4. Are there penetration tests?
Yes. We agree the scope, frequency and testing body with you as part of the security concept and present the results for your procurement procedure.
5. How is the role and permissions concept structured?
In several levels. Case handling, accounting and management work in the same system without everyone seeing everything. Permissions are assigned per role, not per person – this keeps the effort low when staff change and makes the assignment traceable.
6. Is there multi-factor authentication?
Yes, in particular for privileged access. Administrative accounts are the route through which an attacker can do the most damage; that is exactly where the second factor matters most.
7. How is data encrypted?
Data is appropriately encrypted during transmission and storage. We name the methods used in the security concept and not on a public page – there they would only be a pointer for those who are not supposed to know them.
8. Which certifications does the data centre have?
The operator of the data centre in which netPension® runs in cloud operation is certified to ISO/IEC 27001, holds a BSI C5 attestation at level 2 and processes data in accordance with the General Data Protection Regulation. The certificates relate to the data centre, not the software – we present them with the documentation.
In netPension®
You decide who may see and change what.
The role and permissions concept separates tasks within the same system. Logging, history tracking, journals and follow-ups record what was done, when and by whom – the basis for audits and supervision.
Multi-level role and permissions concept
Logging of access and changes
Four-eyes principle for sensitive processes
Multi-factor authentication, in particular for privileged access
History tracking, journals and follow-ups
No installation and no data storage at the workstation
Regulation
DORA as a guardrail.
We follow the requirements of the European DORA regulation on ICT risk management, incident reporting and resilience. Data protection is governed by the General Data Protection Regulation; for customers in cloud operation, data processing on their behalf is regulated by contract.
In the specialist procedures
Security does not end at the data centre.
The reporting channels themselves are encrypted and tested: the paying agent reporting procedure uses the prescribed security procedure of the healthcare sector and is certified by the ITSG; report files are collected and transmitted via a secure connection.
Data sovereignty
What should not go into the cloud does not have to go there.
Even in SaaS operation, not all data has to be processed centrally. Where necessary or desired, an edge component can be added on the customer's premises to take over individual steps on site – check, filter, encrypt, process locally. Only what is needed there is then passed to the central application. This is not a third operating model but an addition within the SaaS solution.
Frequently asked questions
Two points that are often confused.
Is netPension® itself certified to ISO 27001?
It is the data centre in which netPension® runs in cloud operation that is certified, not the software. We prove this with the operator's certificates. Certification of the software would be a different statement, and we do not claim it.
netPension® ZMV is certified by the ITSG; the certification is renewed annually.
Does all of this also apply when operated in-house?
The architecture applies unchanged: no data storage at the workstation, encrypted transmission, the same role and permissions concept, the same logging. You or your IT service provider are then responsible for the data centre, backups and availability; we supply the information for your security concept. To on-premise
Would you like to see what this looks like for you?
We show you netPension® along the lines of your questions – no slides, but the running software. Give us a call or request a demo.