Security and NIS2

This page brings together, in one place, the information customers ask us for when assessing SupportHost as a supplier, for example for the supply chain security requirements of the NIS2 Directive or for their GDPR record of processing activities. You can share this link with your consultant or your security officer.

The provider you have a contract with is SupportHost OÜ, Ahtri tn 12, 15551 Tallinn, Estonia.

NIS2

SupportHost OÜ is subject to the NIS2 Directive as a provider of domain name registration services, supervised by the Estonian cybersecurity authority (Riigi Infosüsteemi Amet, RIA), with which it is registered. Significant incidents are reported to the authority within 24 hours, as required by law.

Certifications

SupportHost OÜ is certified to ISO/IEC 27001 (information security), ISO/IEC 27017 (cloud services security), ISO/IEC 27018 (protection of personal data in the cloud), ISO 9001 (quality) and ISO 14001 (environment). Certificates, certification bodies, scopes and expiry dates: Certifications page.

The data centers hosting our servers hold their own certifications: you will find them, provider by provider, in the list of sub-processors.

Where data is located

Customer data is stored in Europe, except for services in the USA expressly chosen by the customer. Our staff and contractors work from the European Union or from countries covered by an adequacy decision of the European Commission; failing that, under the safeguards required by the GDPR (standard contractual clauses). The same applies to providers of ancillary services, listed with their safeguards in the sub-processors section.

Technical and organisational security measures

Across the whole infrastructure

• Data centers with physical access control, continuous video surveillance, redundant power and cooling, fire protection.
• Network-level DDoS protection.
• 24/7 monitoring of hosting servers and managed servers, with automatic alerts and staff always on duty (unmanaged servers are not monitored by us).
• Administrative access to servers only with personal cryptographic keys, one for each staff member; password login is disabled.
• Two-factor authentication on supplier and domain registry panels.
• Administrative access logs kept for 30 days.
• Staff access revoked immediately when someone leaves or changes role, and reviewed at least once a year.
• Qualified staff, working according to documented internal procedures.

On shared hosting

• Each account is isolated from the others: a compromised website cannot read other customers’ files.
• Web application firewall and intrusion protection, with automatic blocking of attacks.
• Malware scanning of files.
• Automatic daily backups, kept for 30 days, on offsite storage separate from the hosting servers.
• Control panel updates are automatic; operating system updates are installed periodically by our staff.

Encryption

• Connections to panels and services protected with TLS.

Who does what

On unmanaged servers the customer has full administrative access: the measures on the operating system and the data are the customer’s.

Security incident handling

• Our internal monitoring and customer reports let us spot problems: the staff on duty classify them by severity and handle them according to documented internal procedures.
• If a security breach involves your personal data (for example unauthorised access or data loss), we notify you within 48 hours of becoming aware of it, by e-mail to your account address. Information that is not available right away is sent as soon as we have it, in stages if necessary.
• The notice states what happened, which data is involved, the likely consequences and the measures taken or proposed.
• The same commitment is written in our data processing agreement.
• Faults and outages, such as a server or website being unreachable, are fixed by our staff on duty: they are not data breaches and do not trigger an individual notice.
• To report a security issue: open a ticket from the client area or use the contact page.

Business continuity and disaster recovery

• Infrastructure spread across several data centers and providers: a failure at one site does not affect the others.
• 24/7 monitoring with staff always on duty to deal with faults.
• Hosting backups on offsite storage separate from the servers, to restore single websites or a whole server.
• If a hosting server is lost, accounts are restored from backups onto another server. Recoverable data is that of the latest daily backup.
• Documented internal procedures for restoring and moving services.
• Restoring from backups is regularly verified with real tests.

Data protection (GDPR)

• Data processing agreement (Article 28 GDPR): data processing agreement.
• Competent supervisory authority: Andmekaitse Inspektsioon (Estonia).
• We have not appointed a DPO. For data protection requests: a ticket from the client area or the contact page.

Sub-processors

These providers process customer data on our behalf, each under its own data processing agreement. We give at least 15 days’ notice before adding or replacing a sub-processor.

The following also receive data, as independent controllers and only for the service requested: domain registries (NIC.it, EURid, SWITCH and others), SSL certificate authorities and payment providers (Stripe, Revolut, Wise, PayPal).

NIS2 statement

Digitally signed statement on the security measures in place: NIS2 Information Security Statement, version 1 (PDF).