ISMS-manager

Security

Security and privacy

We handle your information with the same principles ISMS-manager helps you apply in your organization.

This panel ships with every instance: administrators can always see the status of these measures and adjust the configurable ones.

Platform measures

Identity and access

Two-factor authentication
With an authenticator app (TOTP) or an email code, plus single-use recovery codes. It can be required for every user or only for administrators.
Brute-force lockout
Five failed attempts lock the account for 30 minutes, and sign-in is rate limited per IP address.
Password policy
Configurable expiry with email reminders. Passwords are stored as salted PBKDF2-SHA256 hashes, never in plain text.
Roles and permissions
Each user only reaches the modules their role allows.

Web application

Protected sessions
They expire after 60 minutes of inactivity and use HttpOnly, Secure and SameSite cookies.
CSRF protection
Every form carries a token against request forgery.
Security headers
CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Encryption in transit
All traffic is served over HTTPS (TLS).

Traceability

Audit log
Who did what and when, with the previous and new values of every change.
Access under control
Sign-ins, failed attempts, lockouts and two-factor changes are all recorded.
Evidence for your audits
The log lets you show when a measure was enabled and who changed it.

Infrastructure and data

Hosted in the European Union
Servers and backups in data centres located in the EU.
Minimal attack surface
Firewall exposing only HTTP and HTTPS; administration via SSH keys, restricted by IP and protected with fail2ban.
Automatic patching
Operating system security updates are applied automatically.
Off-server backups
On the Advanced and Pro plans, an automatic daily backup of the whole server on the provider's European infrastructure, outside the server itself; the last 7 are kept. On the Basic plan, you take them whenever you want from ISMS-manager.

Security as an ongoing practice

Security isn't configured once; it is watched and tested on a regular basis.

  • Regular penetration testing

    Specialists assess the platform to find vulnerabilities before an attacker does.

  • Constant monitoring

    Continuous monitoring of availability, performance and security events, with alerts to the operations team.

  • Vulnerability management

    Dependency reviews and prioritised patching across the application and infrastructure.

  • Incident response

    Incident handling and notification procedure in line with the contract and the GDPR.

Privacy and GDPR

Instances and data are hosted on European infrastructure to help you comply with the GDPR. We act as a processor for the data you manage in your instance, as set out in the data processing agreement (DPA).

This information is for guidance only and does not replace the DPA or the contractual terms.

One server per customer

On every plan your instance runs on a dedicated server, with its own firewall and disk: you never share infrastructure with other customers.

Vulnerability disclosure

If you find a potential vulnerability, write to us at info@cleariso.es. We review every report and get back to you.

Documentation

Contractual documentation (terms, DPA, SLA) will be available before purchase.

Take control of your ISMS

Ask for a demo built around your compliance scenario and see ISMS-manager in practice, or write to us at info@cleariso.es.

Request a demo Try the demo