Security at TeamEngine

Certification and testing

• TeamEngine Group AB (org. no. 556533-1955) is part of the Board Intelligence group. TeamEngine is covered by the group's information security management system (ISMS), certified to ISO/IEC 27001:2022. The certificate explicitly covers TeamEngine's offices in Stockholm and Mauritius.
• The group is also certified to Cyber Essentials Plus, renewed every year.
• The service is penetration tested regularly by an external party, and findings are followed up.
• Compliance with GDPR and other applicable law is verified through internal and external audits.

Hosting and network

• All data in the service is stored in Sweden, in two ISO 27001 certified Tier 3 data centres in Stockholm.
• TeamEngine owns and operates its own servers. The data centre operators have physical access to the equipment only, not to data. The data centres have fire protection, guards, access control, camera surveillance and redundant power and cooling.
• The network is protected by firewalls and segmented to limit the impact of an intrusion. Traffic to and from the servers is monitored by an intrusion prevention system (IPS). Staff reach internal systems over encrypted VPN only.
• Operating systems and applications are patched regularly. Restarts that cause downtime are done at night, Swedish time.
• Disks that may contain customer data are destroyed by a certified partner when replaced or retired.

Encryption

• Data in transit is encrypted with TLS 1.2 or later.
• Data at rest is encrypted with AES-256. Each portal is a separate, encrypted database.
• Backups are encrypted with AES-256.

Authentication

• Users sign in with a password, with BankID, or through the customer's own identity provider with OpenID Connect (single sign-on, with the customer's own MFA policy).
• Two-step verification with a one-time code sent by SMS can be enabled.
• Passwords are stored as one-way hashes, never in clear text.
• Repeated failed sign-ins (for example brute-force attempts) are detected and the account or source is blocked automatically.

Access control and isolation

• Each portal is its own database. Access is controlled by roles and groups at portal and module level, and is checked on every request. The customer's portal administrators decide who has access and what each user can see and do.
• TeamEngine staff have no access to customer content. Support access is given only with explicit approval from the customer's portal administrators.
• Staff access to TeamEngine's own systems requires multi-factor authentication and follows role-based access and least privilege. Staff passwords are randomly generated and kept in a password manager. All staff are bound by confidentiality agreements.

Logging and audit trail

• The portal's change and activity log shows who created, changed, deleted, opened or downloaded information. It is kept for as long as the portal is active and can be made available to the customer.
• Security-relevant system events are logged, protected against tampering and kept for at least 13 months. E-signing logs are kept for 10 years.

Backup and recovery

• Backups are stored separately from the production environment, encrypted, for up to six months.
• Restores are tested regularly by restoring the full system from backup.
• Recovery objectives: RPO 2 hours, RTO 24 hours.
• Storage is redundant in both the production environment and the backup system.

Sub-processors and end of contract

• TeamEngine is the data processor for the content the customer stores in the service, and the data controller for users' contact details.
• Sub-processors are listed on the sub-processor page. Planned additions or replacements are announced to the customer's portal administrator at least 90 days in advance.
• When the agreement ends, the customer can have the portal content exported as a ZIP archive. On the customer's instruction, active data is deleted within 14 days and backups no later than 6 months after that, confirmed in writing.

Security management

• Confidentiality, integrity and availability are the guiding principles. Roles and responsibilities are defined, security measures are documented according to ISO 27002, and measures, policies and procedures are reviewed and updated regularly.
• A named CISO leads the security work, follows up compliance and handles security incidents.
• Risk assessments are carried out regularly, and identified risks are documented and treated.
• Incidents are handled according to an incident response plan based on ISO 27001, documented and followed up. Incident scenarios are exercised regularly.
• All staff complete information security training, and the security policies are available to all employees.

Mobile devices

• The TeamEngine app supports remote wipe of information stored on smartphones and tablets.

AI Services

AI Engine is off until a portal administrator activates it, and it only works with content the user is already allowed to open. Customer data is never used to train AI models. Processing takes place within the EU, encrypted and separated from other organizations' data.

Read the full security description for TeamEngine AI Services.