Physical Security
1 topics
European Data-centers
Cloud providers based in Europe. Data centres hold security certifications (ISO27001, ISO27017, ISO27018, HDS,...) and standard TIER III+ physical and environmental protection measures including security gates, CCTV, guards, and redundant power. Access is strictly limited to authorised personnel.
Implemented
Network Security
4 topics
Internet connections
Multiple redundant internet connections with integrated anti-DDoS protection are managed by cloud providers.
ImplementedExternal access
Multiple dedicated IP addresses and a public CDN are provided by cloud providers. Unsecured connections are redirected to secure connections (HTTPS). A web application firewall (WAF) blocks malformed requests.
ImplementedNetwork Isolation
External access distributed per platform based on domain name. Internal VLANs isolate services by layer (frontend, backend, storage, database).
ImplementedCommunication between data centres
A redundant site-to-site connection (IKEv2/IPsec) secures all inter-data-centre traffic, including replication and cross-service communication.
Implemented
Data Security
13 topics
Protection against viruses & malware
Files are automatically scanned by antivirus and antimalware software before being stored.
ImplementedEnd-user authentication
User passwords are hashed with scrypt. The platform offers three configurable password complexity levels (low/medium/high). Login attempts are protected against brute-force attacks: 5-attempt limit followed by a 10-minute lockout.
ImplementedConnection to enterprise directory (SSO)
SAML2 and OpenID connectors are available for seamless enterprise SSO integration, including ADFS/Microsoft.
ImplementedGuest accounts
Limited access for external users can be explicitly assigned via a guest account.
ImplementedAuthentication of support teams
Support team access to customer platforms requires authentication via professional SSO, MFA, and a time-limited random password. An audit trail notification is sent to both the employee and system administrators.
ImplementedManagement of access rights
Platform administrators have full control over user creation, space management, role assignment, tag governance, and usage statistics.
ImplementedSession management
Sessions are authenticated with token-based access; the timeout is configurable and sessions are automatically invalidated on logout or privilege change.
ImplementedEncryption in transit
All data transfers enforce a secure connection (HTTPS with TLS 1.3 or TLS 1.2, using strong cipher suites including AES-256-GCM and ChaCha20-Poly1305).
ImplementedSecurity certificates
TLS certificates are issued via ACME/Let's Encrypt by default, with support for custom certificates. These certificates are monitored and automatically renewed before expiry.
ImplementedStorage & encryption at rest
All data is encrypted at rest on cloud storage solutions using AES disk-level encryption.
ImplementedData classification
Customer content is classified by sensitivity to define access controls, retention rules, and export restrictions. The classification schema is documented and reviewed annually.
ImplementedThird-party services & data privacy
Sub-processors accessing personal data are contractually bound to GDPR requirements and operate exclusively in EU data centres.
ImplementedTrace management, monitoring & alerting
Application and infrastructure logs are centralised in real time via agents on all systems. Automated alerts are sent to system administrators when anomalies are detected.
Implemented
General Data Protection Regulation
5 topics
Disclaimer
A customisable disclaimer is presented on first user authentication.
ImplementedPrivacy Policy
GDPR-compliant privacy policies are published on the website and accessible from within the platform.
ImplementedData Processing Agreement
A Data Processing Agreement is available on the website, covering all customer data processing obligations under GDPR.
ImplementedSubprocessors
Third-party sub-processors that access personal data operate exclusively in EU data centres and are publicly listed on the website.
ImplementedData subject rights
Platform includes built-in tooling to fulfil all GDPR rights: right to be informed, access, rectification, erasure, restriction, portability, objection, and automated decision-making requests.
Implemented
Quality & Service
7 topics
Governance
A team comprising a dedicated project manager and operational, technical, and educational coordinators is assigned per customer deployment, with clearly defined responsibilities.
ImplementedIncident management
Incident management procedures cover planning, classification by severity, coordinated response, and customer notification. Priority-based SLAs with defined acknowledgement and resolution targets.
ImplementedPost-incident review
Every security incident triggers a root-cause analysis and lessons-learned review. Evidence preserved in a tamper-evident audit log to support investigations and regulatory obligations.
ImplementedAvailability
The monthly uptime rate is guaranteed and monitored by an external service. Availability metrics are published and contractually committed.
ImplementedMaintenance
Patches are deployed transparently with minimal downtime. Planned maintenance windows are communicated in advance; emergency patches are applied outside business hours.
ImplementedEvolution
The solution is continuously developed with regular releases. Customers are notified of major updates through the Sphere ecosystem and published release notes.
ImplementedDocumentation
Documentation is published at help.elium.com, updated with each major release, and communicated to customers.
Implemented
Reversibility
4 topics
Restitution of data
A full content export is available at any point during or at end of contract, for archiving or migration purposes.
ImplementedExport format
Export includes JSON metadata files and a full document file tree, compatible with standard archiving tools.
ImplementedData encryption
Export archives are AES-encrypted and password-protected. The password is accessible only to platform administrators.
ImplementedDeletion of data
All customer data is securely destroyed at all locations upon contract termination, with a defined retention period after the effective end date.
Implemented
Backup & Recovery
5 topics
Recovery Time Objective
A documented procedure ensures all services can be restored within defined timeframes following any security incident or disaster.
ImplementedInfrastructure as Code
The full infrastructure state is managed as code (Terraform/Ansible), enabling rapid, reproducible, and auditable environment restoration.
ImplementedBack-ups
Backups are performed daily and replicated to a separate remote data centre. Backup integrity is verified automatically after each run.
ImplementedRecovery
Documented restoration procedures, triggered only when replication-based measures have been exhausted.
ImplementedBusiness Continuity Plan
The multi-site, multi-provider architecture ensures service continuity in the event of critical tooling disruption.
Implemented
Organisation Security
10 topics
Certification
Whatever S.A. is ISO/IEC 27001:2022 certified, covering the design, development, management, and support of the Elium solution.
ImplementedGovernance of security
The CISO role is defined within the organisation. Security governance covers management, human resources, engineering, and operations.
ImplementedInformation system security
Internal IS security policies protect Whatever SA's own assets and underpin the overall security posture of the Elium service.
ImplementedRisk management
An ongoing information security risk analysis covering threats to service continuity. Risks are assessed, treated, and reviewed on a regular cadence.
ImplementedSupplier security
Security requirements are formally included in all supplier agreements. Third-party access to systems is governed by the principle of least privilege. Supplier compliance is reviewed annually.
ImplementedHuman Resource Management
New employee onboarding is formalised with background checks, role-based access provisioning, annual security training, and structured offboarding for all staff.
ImplementedMobility & teleworking
Remote work is governed by strict remote access policies including VPN, MDM-managed devices, and BYOD restrictions to ensure secure work from any location.
ImplementedManagement of assets
All service-related and employee assets are inventoried in an asset management tool. Storage assets are encrypted at rest.
ImplementedSecurity monitoring
The CISO monitors threat intelligence from the Belgian DPA, CNIL, ANSSI, and CERT-EU. Security events are tracked and escalated per documented procedures.
ImplementedAccess control
Employees use unique identifiers with strong passwords and two-factor authentication is mandatory. Access rights are managed by role, reviewed periodically, and revoked immediately on departure.
Implemented
Development Security
5 topics
Protection against OWASP Top 10
Systematic controls are applied across all OWASP Top 10 categories: SQL injection prevention, authentication hardening, CSRF protection, secure dependency management, and more.
ImplementedSecure development lifecycle
Security is integrated at every phase of the development lifecycle: threat modelling at design, mandatory code review for security-sensitive changes, automated static analysis in CI, and security testing in acceptance before production release.
ImplementedProtection of the source code
Source code access is restricted to developers and administrators via unique credentials and mandatory 2FA. All repository access is logged and auditable.
ImplementedDeployment of the web application layer
Frontend releases gated by protected version tags in the repository. Deployment pipeline enforces review and approval before publishing to production.
ImplementedDeployment of the logical application layer
Backend releases identified by unique image SHA and deployed via Kubernetes manifest update. All changes tracked in version control.
Implemented
Operational Security
8 topics
Infrastructure as Code
All infrastructure components are defined in code (Terraform, Ansible) and managed via version control tools. Changes are validated and applied through automated provisioning pipelines.
ImplementedTechnical Documentation
Technical documentation maintained alongside infrastructure projects, version-controlled, and updated with every infrastructure change.
ImplementedService containers
Application service containers are orchestrated by Kubernetes, enabling zero-downtime updates, auto-scaling, and consistent deployment environments.
ImplementedHardening
System hardening is applied automatically via provisioning tools on installation and validated against CIS Benchmark in CI.
ImplementedRemote access
Direct system access requires a VPN connection and dedicated credentials. Infrastructure as Code minimises the need for direct server access.
ImplementedChange management
All changes to infrastructure and application layers follow a documented change-control process: impact assessment, approval, rollback plan, and post-deployment verification. Emergency changes require retrospective review.
ImplementedUpdating & applying security patches
OS and service patches are applied transparently with minimal downtime. Critical patches are prioritised and deployed within defined SLAs using automated pipelines.
ImplementedSecurity audits
Penetration tests are conducted regularly by independent third parties and vulnerability scans are automated. Findings are assessed and remediated per defined SLAs.
Implemented
Have a security or compliance question?
See it on your own knowledge.
Our security team handles vendor reviews, RFPs, audits, and architecture questions every week. Reach out – we answer fast.