Security and GDPR

From May 25, 2018 a new data protection legislation, GDPR, regulates the handling of personal data. As a consequence we have put in place new security measures and procedures as described below. We warrant that all servers that we use to transfer and store files are located within the EU.

Below FileCentral is reference as "the Service".

• File types
• Secure connections via https
• Passwords
• Files
• Card payments
• The application

File types

Files not containing personal data

If a file does not contain personal data it is most likely not affected by GDPR and can be transferred via FileCentral without further measures.

Files containing personal data, encrypted

If a file that contains personal data is encrypted by the sender before transfer, for example as a password protected zip archive, it is possibly not affected by GDPR since it is not possible to access the personal data without the decryption key. The encryption algorithm used should be classified as strong, i.e. AES. Software tools such as WinZip and 7-zip are available both for Windows and Mac and support AES encryption.

However, the legal position regarding GDPR and encrypted files is not fully clear at this point in time.

Files containing personal data, not encrypted

If a file contains personal data and is not protected by strong encryption the sender of the file, the data controller, must assess whether the sensitivity of the data makes it feasible to transfer the file via FileCentral. Also, a written Data Processing Agreement (DPA) must be signed between the sender and Braxo AB, the company that operates FileCentral.

All files transferred via FileCentral are stored encrypted. The sender has the possibility of setting a password for each transfer. In this case Braxo AB will not have access to the encryption key and thereby cannot access the data in the files.

When a transfer is cancelled the files are permanently deleted from our servers within one minute. If an account is cancelled, all account information, all files and the account transfer history is deleted.

Secure connection via https

The communcation between the web browser and FileCentral is always performed via https. This means that the traffic is encrypted. We only support the newer and more secure TLS protocols. When files are uploaded they are encrypted upon receiption, before being stored.

We strive to always be rated at grade A by the test tool SSL Labs.

Passwords

Passwords are always stored as a cryptographic hash (one-way encryption) using the algorithm bcrypt and a strength (cost) of 12. This means that the password hash will take approx 0.4 seconds to generate, providing a strong protection against so called "brute force" attacks.

Remember that long passwords in general are more secure than short passwords and avoid using the same password for multiple services.

To be classified as strong, a password should be completely random and have a high entropy. When using both uppercase and lowercase characters, digits and a few symbols, in total 64 different characters, a password length of 15 characters, for example "A7u21&JD/hU73er", gives an entropy of 90 bits which is considered a strong password.

Files

Files are always stored encrypted using the algorithm AES-128 with a unique initialization vector and unique salt for each transfer.

If the sender does not set a user-defined password for the transfer a password will be generated for the transfer. The encryption key is generated from the password using a so called Key Derivation Function, PBKDF2.

User-specified password are never stored or logged in the FileCentral service.

Passwords generated by the service are stored separated from the files.

Card payments

If you choose to pay for an account using a credit card the payment is securely processed by Stripe, a leading payment provider. Stripe is of course certified and compliant with PCI DSS. Braxo AB can never access any credit card data.

The application

The FileCentral service platform is built using Spring MVC, a web application framework using compiled server-side Java code. Since no interpreting code is used on the platform the risk of server side code injection attacks is minimized.