Security and data governance

Cooperlink's general policy is to retain as little data as possible to provide the service and to preserve the autonomy and ownership of each company's data.

Cooperlink's development team follows best practices in its development. In particular, it follows the OWASP guideline for protection against cyber-attacks. Authentication and connectivity to the database go through generally accepted technologies: Spring security, JWT tokens, Hibernate, ...

The connection of the company's employees to third-party systems through Cooperlink is carried out by identity delegation, which guarantees the preservation of access rights and data security. This means that the user obtains the same rights to access the company's tools directly as to access them via Cooperlink. Authentication is carried out through modern protocols (e.g. OAuth) when the third-party system supports it.

The connection of the partners is protected by Cooperlink which acts as a proxy. Under no circumstances do partners have direct access to the company's tools. The documents exchanged within the workspace are hosted in a separate and isolated storage space (shadow storage). Access to documents in workspaces is made from this storage space through the bridge service(message broker). They therefore ensure the security and segregation of data.

Cooperlink servers are protected by firewall and reverse proxy. All data in transit is end-to-end encrypted in SHA-256/TLS, and a chunking method is applied on the bridge service. All communications require an HTTPS connection.

All data from all customers and partners is logically (or physically in the case of remote communications) separated and linked to a unique corporate identifier.

A decoupling is carried out between the storage and processing of the data. The database that operates Cooperlink is isolated from the application.

Each user has a personal account on Cooperlink, as well as delegated access to the company's tools (see above).

Application administrators can assign roles to users with a custom set of permissions.

All user activities, API, automated processes, etc. are recorded in an audit trail log.

In the event of a critical security breach, Cooperlink implements the necessary means as quickly as possible in accordance with its terms and conditions.

Cooperlink adheres to the GDPR regulation and shall be considered by the customer as a data processor when it provides hosting, outsourcing and/or has access to the data (e.g. for configuration) . In this case, a private data processing agreement must be signed between the parties (DPA - Data Processing Agreement). The customer is in any case considered as a Data Controller.

Cooperlink provides a high level of security, suitable for normal use of services, namely the management of construction projects in a professional context. The customer and users agree to use the platform for this purpose.

In general, it is recalled that Cooperlink provides the means to securely exchange information between companies (including documents, and emails if necessary). It is the Responsibility of the Data Controller to verify that the sensitivity of this information (as well as the content of documents and emails) complies with the security measures put in place by Cooperlink. Cooperlink has no control over the use of the platform by the Data Controller, it can not be held responsible for the data and content exchanged.

The processing of the data is necessary for the performance of the contract between the Data Controller and its partners, or failing that, for the pursuit of legitimate interests (guaranteeing the security of information and processing information relating to commercial projects in particular). It is limited to the data necessary for the proper performance of the service.

The nature and purpose of the processing of the personal data of the controller are

• Administering access from internal users, partners, and visitors to manage access to Cooperlink.
• The provision of a support service to users (e.g. instant messaging, ticketing, support, product training, ...)
• The provision of communication services (e.g. activities, reminders, ...)
• The provision of collaborative writing services (e.g. co-authoring of office documents)
• Monitoring and supervising the proper functioning of Cooperlink

The Data Controller is solely responsible for all data inserted in Cooperlink (for example, a comment, the description of a task, the title of a document, its content, a note, ...).

Cooperlink only communicates personal data to third-party services for

• The provision of a support service to users (e.g. instant messaging, ticketing, support, product training, ...)
• The provision of communication services (e.g. notifications, reminders, updates, ...)
• The provision of collaborative writing services (e.g. co-authoring on office documents)

With the exception of these services, personal data is processed exclusively by Cooperlink and, where applicable, by the management team and by trusted senior managers who have received prior training.

Cooperlink records all business activities, application events and a list of errors. Nearly 150 events are listed including editing a file, renaming, publishing to a partner, downloading, uploading, adding users, changes in rights, ...

The most important information is disseminated in the application and/or in the API.

Cooperlink logs are archived twice a day for long-term archiving in a space accessible only to administrators.  Cooperlink also logs application activities (connection attempts, etc.).

A backup copy of the database is made daily. For cloud customers, this copy is kept in Cooperlink's cloud infrastructure. For on-premise clients, this copy is stored on a network server.

The customer can subscribe to a long-retention backup copy on a dedicated server.

Cooperlink's access to production sites for installation and maintenance requires a VPN or SSH, and IP restriction based on fixed IP addresses. Access to these nodes is only performed by management and trusted staff who have received prior training.

Cooperlink has a strict internal policy on the protection of data, and more specifically personal data, within the company, including:

• The development of Cooperlink is carried out exclusively by technical employees within Cooperlink. All employees undergo background checks before being hired. Access to the production environment is carried out by dedicated senior employees, supervised by the management team, or carried out by the management team itself.
• All Cooperlink employees are subject to non-disclosure obligations.
• All Cooperlink employees agree not to use or store data on equipment beyond the company's control and storage on removable media is prohibited.
• All assets owned by Cooperlink are encrypted.

Cooperlink has separate environments for development, testing and production.

The technical team follows an agile development method based on sprints lasting approximately 1 month followed by a quality control procedure.

Before a new version is put into production, a code review is carried out by Cooperlink executives or trusted employees with more than 15 years of experience in application development.

Cooperlink has developed a Network Operations Center that is an integral part of its overall Information Security Management System (ISMS). This center continuously evaluates the availability of service at Customers, load parameters and collects error reports for regular monitoring and fast processing. Cooperlink also provides a user portal to report at https://support.cooperlink.io > Report incident or data breach.

Cooperlink maintains a record of incidents detected in production environments as well as a record of user reports. The processor monitors the application's analytical data and regularly evaluates its usage. Inconsistent use or abnormal application load is reported internally and handled promptly.

Logs and alerts are evaluated daily by the management team and by trusted senior managers who have received pre-training.

Through its (distributed) network architecture and integration with third-party systems, Cooperlink offers a high degree of reliability to ensure business continuity. This is because an incident that appears on a dedicated environment does not affect the availability of the service in other environments.

In the event of a major failure of Cooperlink resulting in the interruption of the exchange service and automated data processing, the information stored on third-party systems remains fully accessible. This architecture therefore provides users with continuity of their critical activities.

Apart from these elements, Cooperlink has implemented the following strategy to ensure the continuity of services including:

• A disaster recovery plan
• A Network Operations Center aims to ensure availability and fast response time in the event of an incident
• Container-based deployment to enable rapid service and data migration
• The use of a persistent queue for messages exchanged until an acknowledgement of receipt is received. If the service is restarted, the messages are rerun.
• The use of cloud service providers with a high degree of availability and high SLAs
• Multi-cloud approach to balance services in the event of a failure of one of the providers
• In case of on-premise installation, it is the Customer's responsibility to define a service continuity strategy

Cooperlink's software architecture is service-oriented (SOA), multi-tenant, including a communication bus (message broker called Service Bridge) between local and/or public tenants. Unless explicitly required by the Customer, the files are not stored by Cooperlink.

Cooperlink offers a hybrid deployment architecture, whose node installation type is at the Customer's choice: public cloud, dedicated cloud or on-premise. In this way, the Customer has full control over the location of his data.

• In a public cloud architecture, Customer shares a common environment that is logically separated and linked to a unique enterprise identifier. For its cloud infrastructure, Cooperlink makes use of Datacenters located in Europe and offering an availability rate of 99%. Storage in an ISO27001 environment is also possible on request.
• In a dedicated or on-premise cloud architecture, the Customer has its own environment.

Example of deployment architecture