iSAGE Hosting - under the covers
Through our work with young people, our developers have considerable experience in the software, protocols and processes required to ensure the security of data online. We strictly adhere to the requirements of the UK’s Data Protection Act and, building on a close working relationship with the Department of Law at University of Bristol, we support our clients and partners to ensure that the necessary data sharing and management involved in using online systems is undertaken appropriately. We currently securely manage and store educational and personal data for over 1 million learners in England.
We use industry standard security measures to
safeguard learner and administrator data and ensure
that all personal information supplied is held
securely against unauthorised access in accordance
with the Data Protection Act 1998. To do this we
implement a layered approach to security (from
physical infrastructure through to application logic).
Infrastructure Security
Our solutions use secure protocols (HTTPS) where any data is accessible. We utilise auto logout functionality after a pre-determined time of inactivity. We have firewalls in place for the production system, using two Cisco ASA5510 appliances. Our website data tier is separated from our application tier and therefore rendered inaccessible externally. Further detail can be provided about technical set-up if required.Application Security
All i-Sage products operate on a password access basis with passwords being linked to specific individuals. Visibility of learner passwords is restricted to the individual learner only and if passwords are to be reset, this can be done by either the learner or the Home Learning Provider of the learner. All user access is restricted and controlled at a local authority level with permissions granted based on the roles of individuals. The restricted access ensures that users accessing the system need to have a valid username and password and are only able to see information available for that permission level.Data Security
All your data is backed up on a nightly basis and data is kept in a secure storage unit accessed only by those staff members with rights. Data that includes personal and sensitive information is required to be sent to our servers through our secure data transfer tool. Access to this site is given only to authenticated and named individuals in an area who can only access the site using a personal login and password. We require that data is sent to our servers via a secure data transfer tool, to ensure learner data is fully protected. Once data has been downloaded from the tool, it is deleted and a copy is kept in a permission restricted storage folder.Learner/user data is only otherwise accepted if it is encrypted to the Advanced Encryption Standard (AES) or equivalent in line with commercial best practice and use a minimum bit strength of 256 bit encryption. The password shall be a minimum of 15 characters and should be communicated to data recipients via separate email. As registered data controllers, i-Sage adheres and works to the 8 principles of the UK Data Protection Act 1988. We work with our clients and partners to ensure that any data sharing and processing is appropriate and secure. Within each of our products there are privacy policies outlining the data that is collected and stored in relation to each product and the uses of the data that is collected. The policies are updated and reviewed annually to reflect changes to our products and to keep it in line with amendment to the Data Protection Act. All of our employees with access to personal data and/or have any direct contact with end users in order to fulfill their roles and responsibilities, are Enhanced CRB (Criminal Records Bureau) checked.