Measures for user identification and authorisation Clause Samples

Measures for user identification and authorisation. ● Employee identity is controlled by a central team, members of which prescribe role identity to an Active Directory system; ● The employee Active Directory system acts as the programmatic source of truth, and federates various levels of authority to security providers that govern systems at varying levels of diligence dependent on the risk those systems pose if identity or credentials were compromised. These systems employ MFA and other sophisticated challenge techniques depending on risk; ● Customer identity is managed by server single-sign on partners as well as our own proprietary identity management framework.

Measures for user identification and authorisation. 5. Opatření pro identifikaci a autorizaci uživatelů:

Measures for user identification and authorisation. Pleo employees are required to use unique user access credentials and passwords for authorization. Pleo personnel are authorized to access Customer Data based on their job function, role, responsibilities and seniority. Access is promptly removed upon role change or termination.

Measures for user identification and authorisation. Single Sign On (SSO) or Active Directory login integration is the recommended approach for Intranet- accessed instances. The standard integration configuration involves authentication on a designated Company server within the customer Intranet. The user accessing a Benchmark URL is re-directed to the authentication server for authentication, the authenticated user ID is encrypted packet and then passed back to the Benchmark URL. The user’s permissions are then validated within Benchmark for the application and business scope being accessed. User passwords are not stored in the Benchmark business database when authentication is via a Company SSO/Active Directory server. For Intranet- accessed instances, new users can automatically begin register within Benchmark Digital on identification and login authentication by the company login server. For Internet-accessed instances, users login via a custom Benchmark Digital user name (set to their email address) and a user-designated password that is hashed with SHA1 and stored within the Benchmark business SQL database. Password resets and updates to the Benchmark user account password are managed by the user and are never emailed or made visible to any user. New users must submit a request with their email address. If the address is matched within the manually-administered Company Directory, a registration email is sent to the email account containing an authentication link to complete the registration process and set the password. If not matched, the request is forwarded to the designated administrator who can validate the request and then initiate the process by adding the record to the Benchmark user database and the Company Directory. Access to databases would be under strict security measures (VPN) and Benchmark guarantees that employees who access it comply with data protection training and binding non disclosure contracts have been signed PII data is encrypted at rest at the field level with a unique AES 256-bit key generated specifically for each customer, which is stored in a secret server and, rotated out annually. All data hosting facilities are monitored by video surveillance on a 24 hour by 7 day, 365 days per year basis in accordance with the Benchmark Digital IT and Data Security Policy. Records are maintained providing evidence of these safeguards by Benchmark Digital’s hosting provider, Rackspace/AWS. All backup and archival media containing Subscriber Data or Subscriber Confidential Information m...