Security And Data Protection FAQ

Wovex in the cloud hosted by Wovex on Azure is accessed through a SSL certified browser connection (256-bit encryption). Any data uploaded/downloaded has the same level of secure encryption.

If this is not enough for you talk to Wovex as we also offer On-Premise hosting for those with even higher security needs.

Wovex uses servers and services from Microsoft on the Azure platform. We host our enterprise customers' data in the region of their choosing. See: https://azure.microsoft.com/en-us/regions/.

Wovex is a cyber-security certified company.

Other technology options are also available to meet the most demanding of needs. Further details on the hosting and security aspects of Wovex are below.

Our Microsoft Azure environment meets a broad set of international, industry-specific, and country-specific compliance standards.
Rigorous third-party audits, such as those conducted by the British Standards Institute, verify adherence to standards-mandated security controls.

Compliance is maintained with leading data protection and privacy laws applicable to cloud services, and the environment complies with international and industry-specific compliance standards, such as ISO 27001, HIPAA, FedRAMP, SOC 1 and SOC 2, as well as country-specific standards such as Australia CCSL, UK G-Cloud, and Singapore MTCS.

There is more on this here, including a list of security certifications held and video overviews: https://www.microsoft.com/en-us/trustcenter/CloudServices/Azure.

For disaster recovery, Wovex has planned for failures and disasters in the cloud. We will recognise a failure quickly through the alerts we have established. We test/rehearse database recovery.

Our databases have capabilities through Azure that support availability and a variety of disaster recovery scenarios. Azure already has resiliency and disaster recovery built into its services.

Wovex can also provide two or three environments for Enterprise customers. These can be used as live environments, training environments, or testing environments for development project releases.

This provides additional recovery options. The database can be restored quickly to the training environment to minimize the loss of availability.

If a new environment needs to be established, we can automatically deploy it.

One aspect of the secure environment is the use of TDE.

The Azure SQL Database has transparent data encryption (TDE)* that helps protect against the threat of malicious activity by performing real-time encryption and decryption of the database, associated backups, and transaction log files.

TDE encrypts the storage of the entire database using a symmetric key called the database encryption key. In the SQL Database, the database encryption key is protected by a built-in server certificate, which is unique for each SQL Database server. For a general description of TDE, see Transparent Data Encryption (TDE).

For information, the SLA we have with Microsoft is:

Compute – 99.95% (21.6 mins downtime potentially per month)

SQL Database – 99.99% (4.3 mins downtime potentially per month)

Storage – 99.90% (43.2 mins downtime potentially per month)

*Transparent Data Encryption (TDE) encrypts SQL Server, Azure SQL Database, and Azure SQL Data Warehouse data files, known as encrypting data at rest. You can take several precautions to help secure the database, such as designing a secure system, encrypting confidential assets, and building a firewall around the database servers. However, in a scenario where the physical media (such as drives or backup tapes) are stolen, a malicious party can just restore or attach the database and browse the data. One solution is to encrypt the sensitive data in the database and protect the keys that are used to encrypt the data with a certificate. This prevents anyone without the keys from using the data, but this kind of protection must be planned in advance.

TDE performs real-time I/O encryption and decryption of the data and log files. The encryption uses a database encryption key (DEK), which is stored in the database boot record for availability during recovery. The DEK is a symmetric key secured by using a certificate stored in the server master database or an asymmetric key protected by an EKM module. TDE protects data "at rest", meaning the data and log files. It provides the ability to comply with many laws, regulations, and guidelines established in various industries.

Yes, with Enterprise Features add-on to your Plan Wovex enables you to choose the preferred geographic region for your data to be stored in.

Wovex files and databases are stored in Azure, which, by default, copies all data three times within one server rack. Furthermore, the data is distributed across three physical racks in the same data centre. This is a ‘locally redundant’ solution.

That depends on the definition of publicly accessible. To clarify, it is possible to access the Wovex database when (a) its address, (b) database name, (c) username, (d) password are known and (e) client IP address is on the allowed hosts' list.
With some guesswork, it might (although it’s highly unlikely) be possible to obtain the database address or name, and even with this information, it is insufficient to access. The connection will be refused as its source is not on the allowed IP list.

​Yes. This can be enabled for customers with the Governance Enterprise add-on. The standard password process allows users to make six password attempts before waiting ten minutes to retry. Passwords can be reset using a link from the login screen.

These settings can also be changed with the Governance Enterprise add-on.

​New users are invited by an authorised user. Password reset links are sent to the user’s registered email address.

For password resets initiated by a user, a reset link is sent to the user's registered email address. (Multi-factor authentication can be enabled with the Enterprise Governance add-on.)

​Yes, using Microsoft Active Directory.

​Users' passwords are stored in the Wovex database, which is created specifically for your organisation.

​Passwords are hashed with the default Microsoft .NET libraries, which are considered an industry standard.

​There is a "forgotten password" function on the login page where the user is prompted to provide their email address. A password reset link is then sent to the user.

​Yes. We verify data on the server side and verify it on the client side.

​Yes. Defender for Cloud and Intruder.io.

​Yes. This is performed twice each year.

​The current application log storing information about logging attempts is in the Wovex database. There are no methods/functions in the code to clear it.

​Yes.

Access is removed when the contract ends, unless we agree a period of read-only access of up to 12 months. You can export your data to Excel and your maps as images before access ends. The database would be deleted using the Azure management portal. Backup copies are retained and deleted in line with the applicable backup schedule.

​Yes, although only a very limited set of users can do it. We also use specialist software to store the Administration passwords, and access is restricted.

Our Privacy Statement explains what personal information Wovex uses, why we use it, who we share it with and how you can exercise your rights. For privacy questions or requests, email [email protected].

Customers decide how personal information they enter into Wovex is used. Wovex normally processes it on their instructions under the customer agreement. We host the service in UK South by default on Microsoft Azure or for Enterprise Customers in the region agreed with each customer, limit access to authorised personnel, and manage security, retention, suppliers and incidents under our Data Protection Policy.

Customer content may also be commercially sensitive even when it is not personal information. Our security controls and customer agreements protect that content too.

If you need the full Data Protection Policy for a procurement or assurance review, email [email protected].

Your data will be hosted in UK South, or if you have an Enterprise plan, you can have Wovex hosted in the region of your choice, e.g. UK customers' data can be hosted in the UK, European customers in Europe, Australian customers in Australia, etc. See: https://azure.microsoft.com/en-us/regions/. Wovex is a cybersecurity-certified company. See How secure is Wovex?

Do customers have data sovereignty? Is the data mine?

Yes, customers have data sovereignty. And if security is a critical aspect due to the kind of work you do, you can also choose to host your data on your own Azure hosting environment within your firewall.

The data your organisation enters into Wovex remains yours. Wovex processes it under your agreement and instructions.

No. Wovex AI may use information you provide to generate guidance or suggestions, but this does not teach or update the underlying large language model. Customer data is not used for AI model training. AI features can also be turned off for your environment.

If you suspect a security incident involving Wovex, contact Wovex Support at [email protected] or use the support route in your agreement. We prioritise the report, investigate it and take steps to contain any issue.

If we become aware of a personal data breach affecting information we process for your organisation, we will notify your designated contact without undue delay, in line with our data processing agreement. We will provide further information as our investigation progresses. Any specific support response times are set out in your service agreement.