Menu
Menu
Security is in our DNA and we consider it our license to operate.
Our customers trust Impero with their data and we combine enterprise-class security features with comprehensive audits of our application and processes. This ensures customer and business data is always protected.
You will rest easy knowing your information is safe, your interactions are secure, and your business is protected.
Impero is hosted and protected by Microsoft Azure using their European data centers.
We use the highest recommended standard of algorithms for encrypting your data, and both data-at-rest and data-in-transit are protected by default.
Ensure only the right people and approved devices can access company information in Impero by implementing features like two-factor authentication or single sign-on.
We take active steps to securely develop and test against security threats to ensure the safety of our customer data, among which are third-party security partners performing detailed penetration tests.
We maintain a disaster recovery program to ensure services remain available or are easily recoverable in the case of a disaster. We employ service clustering and network redundancies to eliminate single points of failure.
We implement security best-practices. In addition to the security measures provided by Microsoft Azure, such as AICPA SOC 2 and ISO 27001, we also meet not just industry-based compliance standards, but the most stringent requirements, in addition to performing regular penetration tests and security audits.
At Impero, we adhere to the strictest data protecting measures both physically and digitally. Our physical offices are subject to the highest standards of security as well as to periodical inspections. Our cyber security is consistently examined with both internal and external penetration tests performed regularly. Independent, external security experts perform periodic web application security testing. Included is the Open Web Application Security Project’s (OWASP) Testing Project, which produces the premier cyber security testing resource. We are, furthermore, using a geo-redundant backup system, which ensures restoration of data in multiple regions. These measures ensure no loss of data should hostile penetration be attempted.
Impero is hosted and protected by Microsoft Azure using their North and Western Europe data centers. All servers and applications are systematized to automatically apply security patches and rebooting if necessary. Any hostile intrusions are immediately detected and deflected by the firewalls.
An ISAE 3000 statement, issued by the International Federation of Accountants, concerning the relevant processes and IT general computer controls operated by Impero is prepared annually by an external audit partner. Part of the controls performed internally is a review of relevant audit statements covering the Microsoft Azure resources. Among these is the SoC2 report that includes, but is not limited to, the following:
Read on for more information on how we protect your data or download our Security White Paper.
Impero A/S, hereafter referred to as ‘the organization’, is a Danish company founded in 2013 and headquartered in Aabyhoej, Denmark. We develop and deliver a software-as-a-service solution for risk and compliance management. The software is hereafter referred to as ‘Impero’ or ‘the solution’.
Impero A/S operates with distributed teams consisting of team members in Denmark, France, Germany, UK, and Hungary.
Due to the distribution of our teams and the many activities offsite we take a strong stance toward security and focus on securing both devices and data through mobile device management as well as the enterprise resources hosted by Microsoft Azure and Microsoft O365.
Security is the most crucial part of our solution and is, as such, reflected in our people, processes, and ways of working. This white paper clarifies how we provide security to our customers and protect their data.
Employee Background Checks
During the hiring process, each employee undergoes a process of background verification. Their criminal records, previous employment records (if any), and educational backgrounds are scrutinized thoroughly. The employee will not be granted access to sensitive information until this background check has been successfully performed.
Security Awareness
Upon induction, each employee signs a confidentiality agreement and an acceptable use policy. The employee then undergoes training in information security, privacy, and compliance.
Impero A/S provides training on specific aspects of security the employee may require in their role. Additionally, we continuously train and educate our employees within extensive areas including information security and privacy as well as ensure their awareness of the organization’s security practices.
External Consultants and Third Parties
Any external consultant or third-party requiring access to the organization’s will be enrolled in our security awareness program.
Secure by design
Security is crucial to Impero’s developmental lifecycle. As such, any code deployed to our production environment will be subject to a range of security measures beforehand.
Encryption in Transit
Impero adheres to the highest recommended standards of encryption. All data transiting between the Impero servers and client browsers is encrypted using TLS 1.2 with only the most secure ciphers enabled with AES encryption and SHA-256 signatures as minimum requirement.
Encryption at Rest
Impero stores data in both a Postgres relational database and in the Azure blob storage, applicable to uploaded files. Both are encrypted using the AES-256 cipher by our hosting provider Azure.
Password Storage
Passwords are not stored in the database. A hashed, salted version of the password is saved instead using the Argon 2 cryptographic hash algorithm. In addition, a pepper (server-side secret, site-wide) is used to generate the hash. The pepper is stored on a separate server from the database.
Impero’s users may, depending on company policy, authenticate using the following methods:
Passwords are subject to complexity requirements. Should an organization elect to use to use two-factor authentication, the application will send a randomly generated code expiring within 60 seconds.
The application saves information in cookies. Cookies are only accessible via an encrypted connection and the cookie containing the session identifier is not available from browser-side scripts.
A server-side session registry ensures that users only access the application using a single browser per session thus mitigating the risk of users neglecting to close a session on a public terminal. Additionally, sessions without activity are invalidated after 60 minutes and the user will need to log in again.
XXS Attacks
For most user interfaces, Impero relies on the React rendering library, a JavaScript library. This protects the application from most XXS attacks. Some legacy parts of the application use server-side templating system with built-in escaping in addition to client-side escaping.
SQL Injection
Impero uses an SQL query builder generating parametrized SQL queries. Handwritten SQL is also thoroughly reviewed and parametrized.
Web Application Security Assessment
Security assessments are conducted periodically by a leading external provider. The assessment covers all relevant security aspects within both the solution as well as the deployed environment. Any potential findings are reviewed and mitigation plans are initiated. Following mitigation, a verification test is performed.
Among others, these assessments ensure that Impero has the adequate safeguards within the areas of:
Security Compliance Audits
An ISAE 3000 statement on the IT general computer controls operated by Impero is prepared annually by an external audit partner. As part of the internal controls performed by Impero, a review of relevant audit statements covering the Microsoft Azure resources. Among these statements is the SoC2 report that covers, but is not limited to, the following:
Hosting is provided by the Microsoft Azure cloud. This includes both the web application as well as any additional services such as logging and all stored data.
Impero is hosted on virtual machines provided by Microsoft Azure, using different operating systems. All servers have systems for automatically applying security patches and rebooting, if necessary.
Impero servers sit behind a secure firewall where only necessary ports are open. In the network behind this firewall, all traffic is end-to-end encrypted – including connections to the database. Servers use a secure configuration with only necessary services enabled as well as rely on SSH keys for remote login whenever the operating system is compatible.
Impero stores logs, for various purposes, at server-, web server software-, and application-level. These logs may be used to track customer issues or identifying malicious activity. Additionally, Impero relies on Microsoft Azure’s monitoring features and in particular its Security Center.
Prior to gaining any access to company resources, Impero requires all devices enrolled in the company’s MDM solution. The MDM solution ensures the devices comply with the security standards set forth by Impero and enforces continued monitoring. Impero’s security policies are comprehensive and include requirements such as:
Access to company resources is granted on the principle of least privilege and role-based permission and always reflect job responsibility. Access rights are subject to recertification.
For additional risk mitigation purposes, Impero enforces multi-factor authentication in order to access company resources including the Microsoft Azure environments.
Impero has established policies and procedures addressing to possibility of security incidents and appropriate responses. There are additional procedures in place concerning violations of information security policies, software malfunctions or security weaknesses and appropriate responses hereto.
Impero is constantly striving to have the optimal security posture. We are constantly searching for improvements to our development practices and security processes so that we may continue to the most secure solution possible and keep our customers’ data safe.
Please reach out to us via support@impero.com, should you have any queries regarding our security practices, as we are happy to provide further information.
Take control of your finance and tax compliance management today!
CVR: 32326676