uAttend Security Overview

uAttend™ Secured Hosting Environment Overview

Workwell Technologies Inc., the developers of the uAttend™ Employee Management Systems hosts all time and attendance data on managed servers at a nationally recognized data center with the following qualifications and parameters.

Certifications and Design

  • SSAE16 certified (SOC reports) (audit report available on request).
  • Dual- city grid power feeds, plus battery backup with automated transfer switch and on- site diesel generator.
  • FM 200 server- safe fire suppression system with early pre- fire detection mechanism.
  • Automatic temperature and climate control system with humidity and temperature sensors located throughout the facility.
  • Biometric and key card security system including man- traps and rack level locking mechanism Staffed 24×7 by data center technicians and engineers and monitored remotely.

Physical and Data Security for uAttend™ Servers

Information is housed in data centers with high levels of physical and data security through detailed lists of authorized personnel, entrance logging, and restricted access protocols, proxycard and biometric security measures, video recording of all activity on premises by the facility managers and RSA SecurID technology.

Personnel
Data center access is only granted to employees who need access as part of their on-going duties with the company, not just for individual visits. All work visits, tours and individual visits are escorted by Data Center personal and require photo identification. No visitor access cards are granted.

A list of authorized and documented personnel is maintained internally with the Data Center and with each of the security teams in charge of the physical security at the different data centers.

Who gets access?
When an employee is deemed by management to require data center access, their name and information is provided to the security team of the data center. This security team, in turn, provides the employee with an RFID card and records their fingerprints for biometric entry verification and security purposes. Access is granted to all of management, all account executives, most technicians, and some software developers. Access can be restricted at any time remotely by the Data Center management.

Access
For an employee to enter into a data center they must have been provided with the correct credentials such as their previously provided RFID card, bio-metric readings, pin codes or passwords. All of these measures are checked and then access is granted. Each instance of entry and exit is logged in the security access database at each facility.
Document Revision Date: March 21, 2010
Document Control Number: 1X302-A7
uAttend™ is a registered trademark of ProcessingPoint, Inc.
ProcessingPoint, Inc. 2796 Loker Avenue West Suite 111 Carlsbad CA 92008

Logging
To gain access all employees use their RFID cards as well as biometric readings. These are inturn logged for all entry and exist instances. To enter into each data center, all employees must also physically sign in and out; information includes entry and exit times, as well as retention of their state-issues driver license or other government-issued photo-ID in some cases.
Video cameras record at all times entry and exit points at all data centers. Video cameras,
furthermore, record video in the aisles where equipment is stored.

Hardware
All hardware, including firewalls, routers, and other key networking equipment in our data centers are physically secured inside the data center, the hardware is stored in rows of individual cabinets, with each cabinet itself secured by a key-lock combination code. Access to computer rooms is restricted by RFID proxy-card and/or biometric security measures. All visitors are escorted at all times and are unable to access any area without escort. Video surveillance provides an additional record for each visit.

Furthermore, for security purposes all hardware in our data center is only marked by barcode.
There are no external markings determining the company or client that is hosted on the server.
No hardware may be removed from any Data Center without prior authorization from Data Center Operations and management.

Data security
All databases, client information systems, customer relationship management systems and other systems used to store customer information are secured using RSA SecurID technology, which is a form of two-factor authentication. Each authorized user is issued an access token with a timelocked security code that changes every 60 seconds displayed on the token. This token code, in combination with a security phrase, which is unique to each employee, and is selected by the employee and never known to any other Data Center staff; RSA technology enables us to remotely restrict access to any employee and view detailed IN/OUT logs for each employee.
The Data Center uses industry standard SSL-based 128-bit encryption for all data communications between our front-end systems and our back-end systems for additional security.

Furthermore, all changes made to our internal systems are logged in a detailed Event Logging mechanism. This log database is stored on a secured server and only senior staff is able to access the logging database servers.

Backup
All core documentation, client information, and customer relationship management systems are meticulously backed up at least once per day, and in some particular pieces of data, up to six times per day.

uAttend™ is a registered trademark of ProcessingPoint, Inc.
Workwell Technologies, Inc. 2796 Loker Avenue West Suite 111 Carlsbad CA 92008