Security and Infrastructure<\/h1>\n<\/div><\/div><\/div><\/div><\/div>Reports and whistleblowers\u2019 safety<\/h2><\/div><\/div><\/div><\/i><\/div>Asymmetric cryptography on textual contents and attachments<\/h2><\/div><\/div>Encryption does not require specific actions by the anti-corruption supervisor or by the whistleblower or any interventions by system administrators. The cryptographic system guarantees that messages and their attachments can only be read by the sender and recipient through the pairing of the public and private cryptographic key<\/strong>.<\/div><\/div><\/div><\/div><\/div>In addition, to protect the identity of the whistleblower and the content of the report:<\/p>\n<\/div>
- <\/i><\/span>\n
Transmission of the digital fingerprint of the message (hash) to the whistleblower e-mail, ensuring the unchangeability of the reports<\/strong>.<\/p>\n<\/div><\/li>- <\/i><\/span>\n
Login with smart card.<\/em>
\n<\/em><\/p>\n<\/div><\/li>- <\/i><\/span>Access regulated in accordance with the privacy policy<\/strong> (password complexity and change);<\/div><\/li><\/ul><\/div><\/div>
![\"Security](\"https:\/\/www.whistleblowing.software\/wp-content\/uploads\/2023\/02\/security-legality-whisteblowing.jpg\" "\\"security-legality-whisteblowing\\"")
<\/span><\/div><\/div><\/div><\/div><\/div>![](\"data:image\/svg+xml,%3Csvg%20xmlns%3D%27http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%27%20width%3D%271000%27%20height%3D%27667%27%20viewBox%3D%270%200%201000%20667%27%3E%3Crect%20width%3D%271000%27%20height%3D%27667%27%20fill-opacity%3D%220%22%2F%3E%3C%2Fsvg%3E\")
<\/div><\/div>Software safety and infrastructure<\/h2><\/div><\/div><\/div>- <\/i><\/span>\n
Delivered by DigitalPA dedicated Servers<\/strong>: Maximum data security and protection at the highest levels, guaranteed by the DigitalPA ISO 27001\/2014 certification and by the certified server farm infrastructure ISO 27001\/2014;<\/p>\n<\/div><\/li>- <\/i><\/span>\n
OWASP tested (Open Web Application Security Project)<\/em> –\u00a0<\/strong> Testing on the system vulnerability and safety through \u201cbest practices\u201d;<\/p>\n<\/div><\/li>- <\/i><\/span>Integrated Firewall Hardware and Software<\/strong>: Each platform has an integrated firewall with very strict rules, which limit accesses and actions to the software. The firewalls integrate and enhance security;<\/div><\/li>
- <\/i><\/span>\n
I<\/strong>P blocking:<\/strong> Limited access to client\u2019s IP addresses list. The platform can then be accessed from the internet or exclusively from the intranet;<\/p>\n<\/div><\/li>- <\/i><\/span>\n
SSL Certificate:<\/strong> Whistleblowing is only accessible through HTTPS (Secure Sockets Layers);<\/p>\n<\/div><\/li>- <\/i><\/span>\n
IP and SSL<\/strong> Certificate: dedicated for each customer;<\/p>\n<\/div><\/li>- <\/i><\/span>\n
User input validations<\/strong>: the platform is built with a user validation \u2013 based approach. Through extremely strict rules the user input is verified both at a client\/server level;<\/p>\n<\/div><\/li>- <\/i><\/span>\n
SRF Prevention:<\/strong> all requests managed by the platform are protected by CSRF token;<\/p>\n<\/div><\/li>- <\/i><\/span>\n
Compliant with ISO 37301 and ISO 37001 standards<\/strong> dedicated to compliance and anti-corruption management systems.<\/p>\n<\/div><\/li><\/ul><\/div><\/div><\/div><\/div>
Reports and whistleblowers\u2019 safety<\/h2><\/div><\/div><\/div><\/i><\/div>Asymmetric cryptography on textual contents and attachments<\/h2><\/div><\/div>Encryption does not require specific actions by the anti-corruption supervisor or by the whistleblower or any interventions by system administrators. The cryptographic system guarantees that messages and their attachments can only be read by the sender and recipient through the pairing of the public and private cryptographic key<\/strong>.<\/div><\/div><\/div><\/div><\/div>In addition, to protect the identity of the whistleblower and the content of the report:<\/p>\n<\/div>
- <\/i><\/span>\n
Transmission of the digital fingerprint of the message (hash) to the whistleblower e-mail, ensuring the unchangeability of the reports<\/strong>.<\/p>\n<\/div><\/li>- <\/i><\/span>\n
Login with smart card.<\/em>
\n<\/em><\/p>\n<\/div><\/li>- <\/i><\/span>Access regulated in accordance with the privacy policy<\/strong> (password complexity and change);<\/div><\/li><\/ul><\/div><\/div><\/span><\/div><\/div><\/div><\/div><\/div><\/div><\/div>
Software safety and infrastructure<\/h2><\/div><\/div><\/div>- <\/i><\/span>\n
Delivered by DigitalPA dedicated Servers<\/strong>: Maximum data security and protection at the highest levels, guaranteed by the DigitalPA ISO 27001\/2014 certification and by the certified server farm infrastructure ISO 27001\/2014;<\/p>\n<\/div><\/li>- <\/i><\/span>\n
OWASP tested (Open Web Application Security Project)<\/em> –\u00a0<\/strong> Testing on the system vulnerability and safety through \u201cbest practices\u201d;<\/p>\n<\/div><\/li>- <\/i><\/span>Integrated Firewall Hardware and Software<\/strong>: Each platform has an integrated firewall with very strict rules, which limit accesses and actions to the software. The firewalls integrate and enhance security;<\/div><\/li>
- <\/i><\/span>\n
I<\/strong>P blocking:<\/strong> Limited access to client\u2019s IP addresses list. The platform can then be accessed from the internet or exclusively from the intranet;<\/p>\n<\/div><\/li>- <\/i><\/span>\n
SSL Certificate:<\/strong> Whistleblowing is only accessible through HTTPS (Secure Sockets Layers);<\/p>\n<\/div><\/li>- <\/i><\/span>\n
IP and SSL<\/strong> Certificate: dedicated for each customer;<\/p>\n<\/div><\/li>- <\/i><\/span>\n
User input validations<\/strong>: the platform is built with a user validation \u2013 based approach. Through extremely strict rules the user input is verified both at a client\/server level;<\/p>\n<\/div><\/li>- <\/i><\/span>\n
SRF Prevention:<\/strong> all requests managed by the platform are protected by CSRF token;<\/p>\n<\/div><\/li>- <\/i><\/span>\n
Compliant with ISO 37301 and ISO 37001 standards<\/strong> dedicated to compliance and anti-corruption management systems.<\/p>\n<\/div><\/li><\/ul><\/div><\/div><\/div><\/div>
Asymmetric cryptography on textual contents and attachments<\/h2><\/div><\/div>Encryption does not require specific actions by the anti-corruption supervisor or by the whistleblower or any interventions by system administrators. The cryptographic system guarantees that messages and their attachments can only be read by the sender and recipient through the pairing of the public and private cryptographic key<\/strong>.<\/div><\/div><\/div><\/div><\/div>In addition, to protect the identity of the whistleblower and the content of the report:<\/p>\n<\/div>
- <\/i><\/span>\n
Transmission of the digital fingerprint of the message (hash) to the whistleblower e-mail, ensuring the unchangeability of the reports<\/strong>.<\/p>\n<\/div><\/li>- <\/i><\/span>\n
Login with smart card.<\/em>
\n<\/em><\/p>\n<\/div><\/li>- <\/i><\/span>Access regulated in accordance with the privacy policy<\/strong> (password complexity and change);<\/div><\/li><\/ul><\/div><\/div><\/span><\/div><\/div><\/div><\/div><\/div><\/div><\/div>
Software safety and infrastructure<\/h2><\/div><\/div><\/div>- <\/i><\/span>\n
Delivered by DigitalPA dedicated Servers<\/strong>: Maximum data security and protection at the highest levels, guaranteed by the DigitalPA ISO 27001\/2014 certification and by the certified server farm infrastructure ISO 27001\/2014;<\/p>\n<\/div><\/li>- <\/i><\/span>\n
OWASP tested (Open Web Application Security Project)<\/em> –\u00a0<\/strong> Testing on the system vulnerability and safety through \u201cbest practices\u201d;<\/p>\n<\/div><\/li>- <\/i><\/span>Integrated Firewall Hardware and Software<\/strong>: Each platform has an integrated firewall with very strict rules, which limit accesses and actions to the software. The firewalls integrate and enhance security;<\/div><\/li>
- <\/i><\/span>\n
I<\/strong>P blocking:<\/strong> Limited access to client\u2019s IP addresses list. The platform can then be accessed from the internet or exclusively from the intranet;<\/p>\n<\/div><\/li>- <\/i><\/span>\n
SSL Certificate:<\/strong> Whistleblowing is only accessible through HTTPS (Secure Sockets Layers);<\/p>\n<\/div><\/li>- <\/i><\/span>\n
IP and SSL<\/strong> Certificate: dedicated for each customer;<\/p>\n<\/div><\/li>- <\/i><\/span>\n
User input validations<\/strong>: the platform is built with a user validation \u2013 based approach. Through extremely strict rules the user input is verified both at a client\/server level;<\/p>\n<\/div><\/li>- <\/i><\/span>\n
SRF Prevention:<\/strong> all requests managed by the platform are protected by CSRF token;<\/p>\n<\/div><\/li>- <\/i><\/span>\n
Compliant with ISO 37301 and ISO 37001 standards<\/strong> dedicated to compliance and anti-corruption management systems.<\/p>\n<\/div><\/li><\/ul><\/div><\/div><\/div><\/div>
In addition, to protect the identity of the whistleblower and the content of the report:<\/p>\n<\/div>
- <\/i><\/span>\n
Transmission of the digital fingerprint of the message (hash) to the whistleblower e-mail, ensuring the unchangeability of the reports<\/strong>.<\/p>\n<\/div><\/li>
- <\/i><\/span>
\nLogin with smart card.<\/em>
\n<\/em><\/p>\n<\/div><\/li>- <\/i><\/span>
Access regulated in accordance with the privacy policy<\/strong> (password complexity and change);<\/div><\/li><\/ul><\/div><\/div><\/span><\/div><\/div><\/div><\/div><\/div>Software safety and infrastructure<\/h2><\/div>
<\/div><\/div>- <\/i><\/span>\n
Delivered by DigitalPA dedicated Servers<\/strong>: Maximum data security and protection at the highest levels, guaranteed by the DigitalPA ISO 27001\/2014 certification and by the certified server farm infrastructure ISO 27001\/2014;<\/p>\n<\/div><\/li>
- <\/i><\/span>
\nOWASP tested (Open Web Application Security Project)<\/em> –\u00a0<\/strong> Testing on the system vulnerability and safety through \u201cbest practices\u201d;<\/p>\n<\/div><\/li>
- <\/i><\/span>
Integrated Firewall Hardware and Software<\/strong>: Each platform has an integrated firewall with very strict rules, which limit accesses and actions to the software. The firewalls integrate and enhance security;<\/div><\/li>- <\/i><\/span>
\nI<\/strong>P blocking:<\/strong> Limited access to client\u2019s IP addresses list. The platform can then be accessed from the internet or exclusively from the intranet;<\/p>\n<\/div><\/li>
- <\/i><\/span>
\nSSL Certificate:<\/strong> Whistleblowing is only accessible through HTTPS (Secure Sockets Layers);<\/p>\n<\/div><\/li>
- <\/i><\/span>
\nIP and SSL<\/strong> Certificate: dedicated for each customer;<\/p>\n<\/div><\/li>
- <\/i><\/span>
\nUser input validations<\/strong>: the platform is built with a user validation \u2013 based approach. Through extremely strict rules the user input is verified both at a client\/server level;<\/p>\n<\/div><\/li>
- <\/i><\/span>
\nSRF Prevention:<\/strong> all requests managed by the platform are protected by CSRF token;<\/p>\n<\/div><\/li>
- <\/i><\/span>
\nCompliant with ISO 37301 and ISO 37001 standards<\/strong> dedicated to compliance and anti-corruption management systems.<\/p>\n<\/div><\/li><\/ul><\/div><\/div><\/div><\/div>
- <\/i><\/span>
- <\/i><\/span>
![\"infrastructure-security-whistleblowing-software\"](\"https:\/\/www.whistleblowing.software\/wp-content\/uploads\/2020\/11\/registrazione-e-segnalazione-en.jpg\" "\\"infrastructure-security-whistleblowing-software\\"")
<\/span><\/div><\/div><\/div><\/div><\/div>