OutSystems uses appropriate technical, organizational, and administrative security measures to protect the personal data it processes on behalf of its customers from accidental or unlawful loss, misuse, unauthorized access, disclosure, alteration and destruction.
OutSystems keeps customer data in the AWS Region selected by the customer, enabling compliance with data residency regulations. In the platform, access to customer data is restricted to the OutSystems support team, and accessed only when necessary to provide services to the customer. However, customers are still responsible for developing applications that follow best practices for data security.
OutSystems automatically backs up production databases, and customers can request a database restore to any time in the last 15 days. For example, if a developer introduces a bug that corrupts or deletes data, by restoring to a specific time, the customer can avoid or minimize data loss.
Table of contents
OutSystems takes classification into consideration and categorizes data to help determine the appropriate access controls and handling procedures. Classification ensures that data is encrypted at rest and in-transit so that even if it is intercepted, it remains unreadable.
Encryption is a key component of the OutSystems security architecture, and all data on the platform is encrypted at rest. Additional notable encryption mechanisms provided by our platform include:
OutSystems periodically removes temporary files from the front-end storage. Upon termination of an enterprise subscription, we retain customer data for the default retention period. After the period ends, we destroy the customer’s virtual infrastructure.
AWS is then responsible for ensuring that customer data is not exposed to unauthorized individuals, including best practices for destroying data at the end of life for storage devices, as described as follows:
"When a storage device has reached the end of its useful life, AWS procedures include a decommissioning process that is designed to prevent customer data from being exposed to unauthorized individuals. AWS uses the techniques detailed in DoD 5220.22-M (“National Industrial Security Program Operating Manual “) or NIST 800-88 (“Guidelines for Media Sanitization”) to destroy data as part of the decommissioning process. All decommissioned magnetic storage devices are degaussed and physically destroyed in accordance with industry-standard practices.”
Refer to the OutSystems Data Processing Agreement (DPA) for additional details on how OutSystems takes proper care of your data.
GDPR provides greater levels of data protection and control to any European citizen, but it has a worldwide reach. By requiring companies to be more transparent about how they collect and use personal information, it promotes the responsible use of data.
This is something OutSystems has been committed to since it was founded. Our relationships with customers are strengthened because we partner with them to ensure their data is used the way they want, as well as helping them ensure their own compliance using our platform. To reinforce our dedication to GDPR compliance, OutSystems enables customers to choose the location where their environment will be provisioned. Please refer to our available region page for detailed information on these options.