How does B Squared ensure secure storage of the data I hold?

Protecting data to and from your browser (in transit)

Our software is only available via HTTPS SSL encrypted websites. If you try to access one of our sites via HTTP (unsecure), we automatically transfer you to a secure connection. This prevents users from accessing our site insecurely.

The SSL encryption between us is created using industry standard encryption techniques. We regularly review the cipher suites and encryption methods we accept to ensure that vulnerabilities have not been detected, compromising their effectiveness. Any insecure suites are removed and cannot be used to create a secure connection to us. The benefit of this approach is that it reduces the chance of data being breached, however is does dramatically reduce the support for browsers by customers. Whilst this may affect systems running older machines, it also raises awareness to those users that they are also vulnerable.

Data Centre security

B Squared owns and runs its own servers out of 2 data centres located in Farnborough, Hampshire, UK and Slough, Berkshire, UK. We collocate our servers with another company that is responsible for providing us with power, network, cooling and space. They are also responsible for controlling the secure firewall between the external and internal network on our instruction only.

Physical access to the data centre is heavily restricted, and is controlled both at the perimeter and at the building by trained professional security staff. The data centre sites are monitored by CCTV 24 hours a day and are also monitored by other additional intrusion prevention systems. Access is only granted to those who have been authorised in advance or are accompanied by an authorised person. Such access would be subject to identification checks prior to entry. Biometrics are used to ascertain the identity of authorised person/s, and access to the data centre floor is controlled by an anti-piggyback door system that ensures only one person gains access at a time. Once through, authorised users are then required to provide pin access to the data centre floor and key access to their specified server rack. Individual server access is restricted by lockable face plates on the front of each server.

Our data centres maintain ISO27001 and PCI compliance. Details of this can be found here:

Access control

Access to Connecting Steps is provisioned by a single main system administrator account which is specified by the school. Every account after that is provisioned by the school, and we do not have any access to this functionality. In the unlikely event that you have issues and you have contacted us, we may ask for temporary access to your account whilst we make our investigations.

Access to the back end of our software is restricted to certain employees who require this to maintain the servers and assist with escalated queries from customers. All employees that are given access to the back end, are subject to an enhanced contract of confidentiality and are governed by additional policies and procedures.

When employees with access to the backend are required by schools to access their data, they access it in a raw format to effectively troubleshoot the issue. It is important to remember that this data will only be accessed at the request of the school. It is also important to remember that we cannot give passwords out of user accounts as these are encrypted using one way encryption and therefore cannot be decrypted to view as plain text.

Internal controls

Internally, we have a policy of restricting access globally and then providing access to only the areas that each person is required to access in order to perform their role. This helps control and limit our surface area and track how data moves through the company and audit this effectively. Every employee’s role is policy driven in the company, giving guidance on how data should be protected, distributed and connected. This also comes as part of internal training to help employees better understand their guidance and the reasoning behind why we restrict access in the way we do.

Backup and availability

Our server setup offers replication, failover and backup between data centres. Our backups occur every 15 minutes and we perform more traditional backups daily as well which is also replicated between data centres.

We have a system of monitoring our servers 24 hours a day which notifies us of potential issues that may exist on the platform. We have staff on call who are tasked with resolving issues as soon as possible.

Updates and external review

Our software is constantly being modified and updated to resolve issues that we may have discovered. However, these updates are limited to going live every 6 weeks. This is mainly down to the complexity of the software and the amount of testing that is required to ensure that changes made do not affect other areas of the system. We will however push critical updates live ad hoc should they address a vulnerability or significant performance issue.

Firmware and server updates are applied on a 2-weekly basis, though we do monitor the updates coming through and if a particular update represents as a high risk, we seek to get this installed as soon as possible. Most updates occur overnight and any servers that require restarting are done so during this time.

Our system is externally reviewed when required. We do internal penetration testing with each release and assess the outcome to decide whether we should go live. If we make a change to significant high-risk areas of the system (such as authentication, encryption etc.), we will push forward an externally administered penetration test earlier to assess whether the release is eligible for the live environment.

Sensitive data

As standard, we provide encryption in transit and at rest throughout our platform. We also provide additional levels of encryption for media that is stored that has the potential to contain images of children. However, as part of troubleshooting issues with the system or performing tasks at the request of the schools, we may have to view unencrypted data in order to service those requests effectively.