MOBOTIX CLOUD - PRIVACY and GDPR FAQ

[Mx-JoergS]

This article deals with typical questions about the MOBOTIX Cloud and data protection:

1. How long are log files kept? (accesses, changes, activations)
   Log files are stored for 30 days and then deleted using the ring buffer procedure, so only the last 30 days are accessible.

2. Where are the data centres for the cloud located?
   The data centre for DACH customers is in Frankfurt, recognisable by the URL C013.mobotixcloud.com. You can find other data centres here:
   MOBOTIX CLOUD - Globale Data Center

3. How is the video data or backups deleted?
   The recordings in the cloud are made using the ring storage method and are automatically deleted after x days (according to the subscription booked by the customer) so that the customer can always access the recordings of the last x days.

4. Which certifications and certificates are used in the MOBOTIX CLOUD and in the data centres?

• SOC 1 und SOC 2 konform
• ISO 27001 zertifiziert
• PCI DSS
• ISAE 3402

5. Are the servers redundant, is there a raid system in the background?
   The servers are high-availability servers and the data is secured against failure and data loss by means of redundancy.

6. How is the data encrypted?
   AES 256-bit encryption

7. How is data protection realised?
   We fulfil the DS-GVO8 (GDPR) with our products.
   Security and data protection
   All communication between cameras, the bridge and the devices is encrypted. Two-factor authentication can optionally be used for greater security.
   Fine-grained rights assignment and user management allow you to customise the rights optimally to your needs and data protection.
   All of our German customers’ data is hosted in data centres in Frankfurt am Main. Our EU customers’ data is hosted in data centres in the EU. The data centres are certified (SOC 1+2, ISO 27001), store the data in triple redundancy and thus guarantee availability in accordance with the GDPR.
   A privacy mode is available for end customer sub-accounts to restrict (pixelate or hide) image and audio access by the reseller MOBOTIX CLOUD - Secure connection to the CLOUD.
   User activities are stored in the action and audit logs so that changes can be tracked.

8. Does the CLOUD VMS use an approved cryptographic module that meets or exceeds the requirements of FIPS 140-2 for encryption, hashing and other security-related functions?
   AES 256 bit encryption for video and TLS 1.2 and better

9. Are pen tests carried out regularly with the Cloud VMS system?
   Penetration tests and vulnerability tests are carried out annually.

10. Is the stored data encrypted before it is saved?
    Yes, the data is already secured during buffer storage on the bridge before it is synchronised to the cloud. This is an AES 256-bit encryption.

11. Is it possible to delete the data in the cloud after the deletion period has expired?
    Deletion is carried out by the CLOUD-VMS after the set recording cycle, e.g. after 7 days. If the camera is removed from the cloud, the data is also automatically deleted and can no longer be accessed. This means that the admin user can also initiate the deletion individually.

12. Is the deletion also carried out in the backup?
    Yes, the deletion also takes place automatically in the redundant system

13. Does the provider outsource the data storage?
    The storage on the high-availability server and the redundant systems remain in the assigned data centre. For customers in Germany, this would be Frankfurt.

14. What is the maximum data loss that can be expected in the event of data corruption?
    The data centres are equipped with triple redundant systems and if one server fails, the redundant server also takes over.

Special GDPR functions:

GDPR - Privacy and Audit User (Log)

Privacy and user transparency The cloud offers two great mechanisms to protect the privacy of the cloud owner on the one hand, and on the other hand, every access to the cloud account is recorded in a logbook (audit log). This also allows periodic audits by data protection or works council to be carried out on the system to ensure compliance with data protection guidelines. Private mode: Each sub-account can activate its own privacy mode, ensuring that only users of the account can access the…

Detailed information on the MOBOTIX CLOUD data centre:

MOBOTIX CLOUD - Globale Data Center

** [Screen Shot 2020-09-18 at 16.17.04] ** Where is the customer data stored? The data for customers from Germany are ONLY stored in the data center in Frankfurt. For customers from the USA only in the data centers in the USA. For countries where no data center is established, the data center with the fastest connection to the respective country will be selected, e.g. for South Africa, London or Frankfurt are available. For European countries only data centers in (Amsterdam, London or Frank…

Detailed information on encryption:

MOBOTIX CLOUD - Secure connection to the CLOUD

MOBOTIX Cloud Data Center Authentication For communication with the browser and the mobile app, the MOBOTIX Cloud Data Center server uses a digital certificate from a third-party provider to establish the secure TLS connection. The allow displaying the content of the certificate used to establish the connection, so that users can connection, so that users can check whether they are actually connected to an actual MOBOTIX Cloud Data Center server. MOBOTIX CLOUD Application Authentication MOBOTIX…

Details on data protection and our products:

Mx_CyberProtectionGuide_en_201909.pdf

mx_BR_en_180301_CyberSecurity.pdf

mx_WP_Data_Protection_en_231025.pdf

Cloud Whitepaper
https://www.mobotix.com/en/white-paper-request?documents=cloud