SECURITY

Introduction

Security is the core of our business for two main reasons:

1. Scrive's customers must be able to trust us as a provider of a premium service handling and protecting their legal documents, that does not expose the integrity and the trustworthiness of the documents to any risk. The intention is that documents treated by the service shall have the highest trustworthiness possible in a possible dispute. Because of this, Scrive needs to maintain a high security standard to meet the expectations of our customers.
2. Our customer use our service for storage of their most sensitive company data. When protecting this kind of data, sufficiently good is not good enough. Materials and documents has to be 100% protected and secured.

We always strive for using the latest technology in our service and being the market leader in security. These are some of the Most important security action taken by us today:

• Haskell forms the base of our system
• TrustWeaver secure premium storage
• Most powerful SSL 256 bit encryption for communication with our users through webb and email
• 2048 bit encryption, AES certificate and RSA-keys for internal data transfer between Scrive and our partners.
• Change management processes with several steps of approval
• Strict staff policy for all Scrive employees
• Participation in leading security research through the data security group at Chalmers Technical University.

Haskell

The system behind Scrive is based on Haskell. Haskell is a robust technology that was developed by some of the best mathematical programmers in the world. Two key properties of the technology is the high system stability and reliability that comes with it. This results in lower probability of the occurrence of security holes than that of traditionally used systems. The stability and reliability of Haskell is the main reason why it is used in some of the most security conscious organisations in the world. The usage of Haskell in US government web based platforms handling secret information is just one example of this.

TrustWeaver storage

Scrive stores all legal data (read more under "Legal") at TrustWeaver and we offer our customers to also save their documents in their storage. The TrustWeaver service, TrustWeaver On Demand, is installed in two data centers, geographically separated from each other at a distans larger than 30 km. The atom bomb proof server halls where the TrustWeaver On Demand servers are kept maintains the highest security standards available. They are located in caverns previously used by the Swedish military, and the main data center is classified as secured object according to the Swedish law (1990:217) concerning the protection of critical functions in society. The facilities are guarded by access card controls, closed circuit surveillance camera systems, alarm with motion detectors, fire protection systems, UPS power system with diesel back-up generators, and locked and sealed server rackets which can only be opened with copy protected keys. All ICC-cards are sealed in a ICC-card racket by specially designed adhesive security tape.

SSL 256 encryption

To ensure the security of all communication with our customers via the website and via e-mail, we use 256 bit encryption. This is the most powerful type of standard encryption available, and is practically twice as powerful as the encryption used by the online services of the largest Swedish banks.

2048 bit encrypted internal data transfer

We use the strongest encryption available , 2048 bit, in all communication with our security partners. The connection is secured with an AES certificate. We use our own RSA keys for authentication and authorization to further guarantee the highest reliability possible in our transactions, storage, user administration, and document validation in case they would be requested in a court trial as evidence.

Change management

Our internal processes requires several different layers of approval when being changed. Each change is carefully validated, checked, approved, logged and defined. An automatic mechanism protects the core of the system from unwanted system changes. the protection is active in several layers; when designing, implementing, changing and maintaining the system. We store all historical data and are therefore always able to trace changes back to the very birth of the company.

Staff policy

The company's CEO and CTO are the only individuals with access to the Scrive main servers. We control the background of all employees, who also are required to sign strict and economically powerful privacy contract concerning all sensitive information that could endanger the security of the company or our customers.

Partnership with data security group at Chalmers Technical University

Together with Google, Intel and Klarna, the data security group at Chalmers Technical University has selected Scrive to be part of their web security research program. They are, at the moment, working on the next generation of secure data flow programs. This second generation is the very first one in which it is possible to mathematically prove that some things can not happen. We also develop our system in close cooperation with the security team mentioned above.