Security and privacy
How we protect your business data in Ralect ONE. Everything on this page is also in our data processing agreement and SLA.
Your data kept apart
- Every customer has its own, separate environment.
- Your data is stored encrypted with a key that is only for your company.
- Deleting happens by destroying that key: your data then becomes permanently unreadable.
Access
- Everyone works with their own account; there are no shared accounts.
- Two-step verification with an authenticator app or passkey, with recovery codes.
- Rights per type of data and per action, and per business unit where needed. An administrator cannot grant more rights than they have.
Audit log
- Login attempts, access to data and admin actions are recorded.
- You view the audit log yourself in Ralect ONE.
- Nobody can change or delete the audit log.
Hosting and backups
- Hosting at OVHcloud, with providers that are ISO 27001 or SOC 2 Type II certified.
- Every night an encrypted backup at a separate location in Amsterdam, kept for 14 days.
- Restore within 8 office hours as the target, and we test restoring at least once a year.
The application
- All traffic runs over an encrypted connection.
- All input is checked, with protection against injection and abuse.
- A security test at least once a year; components are updated regularly.
Our team
- Only those who need it for support, maintenance or an outage can access your environment.
- With a personal account and two-step verification, and every access is in the audit log.
- Everyone has signed a confidentiality agreement; access is revoked immediately when someone leaves.
Availability and support
- Ralect ONE is monitored 24 hours a day, 7 days a week.
- We aim for at least 99% availability on working days.
- If the system is down, we respond within 4 hours, within 2 hours with Priority support.
Your data stays yours
- You can always get a full export, up to 30 days after your subscription ends.
- After that we delete your data within 30 days and confirm it in writing.
- Your data is never sold or shared for other purposes.
Who helps us
These parties process data for us, always under agreements at least as strict as our data processing agreement.
Always
Only if you use this module
Frequently asked questions about security
Is Ralect ISO 27001 certified?
Ralect itself does not hold an ISO 27001 or SOC 2 certification. The providers that run Ralect ONE and the backups do. Our own measures are set out concretely and verifiably in the annex to the data processing agreement, and we explain them yearly on request.
Can other customers see my data?
No. Every customer has its own, separate environment with its own encryption key. On request your environment can also run on separate infrastructure.
What happens in a data breach?
We investigate right away and report it to you no later than 48 hours after discovery, with what is known about its nature, consequences and the measures taken. Then we help you with any report to the Dutch Data Protection Authority.
Can I see the documents before becoming a customer?
Yes. We send the data processing agreement with the technical and organisational measures and the SLA with every quote. Want to see them sooner? Request them on our legal page.
Every agreement on paper
You receive the data processing agreement, the measures and the SLA with every quote.