Security
How Viper Systems protects your business data in the managed IT service and in our software, whether a system runs on your own server or on our hosting.
Managed IT: your server
Each company has its own Windows server, hosted on Contabo and managed by Viper Systems. The server accepts connections only through a private VPN, so Remote Desktop is not exposed to the public internet. People reach it with Remote Desktop over the VPN, from any location. Viper Systems keeps the server updated.
Managed IT: backups
- Backups are encrypted and stored offsite on Backblaze B2, up to 5 TB.
- Contabo also takes automatic server backups and snapshots.
- An encrypted offline copy is kept for the business owner. The owner holds the only decryption key, and Viper Systems cannot decrypt it. If the key is lost, that copy cannot be recovered.
- Daily backups keep 30 days of restore points. Monthly restore points are kept for 12 months.
- A single file or the whole server can be restored to any retained restore point. Viper Systems performs the restore.
Managed IT: remote support
Viper Systems connects to office computers with Splashtop Remote Support. For a live session, the person at the computer gives an access code. Computers can also be set up for access when no one is at them.
Managed IT: providers
- Contabo: server hosting
- Private VPN: encrypted link to your server
- Splashtop: remote support
- Backblaze B2: offsite backup storage
Insurance and scope
Viper Systems carries technology errors and omissions liability insurance. Systems that store medical records (HIPAA) or payment card data (PCI) are not part of the managed IT service.
Where your data lives
Custom systems have security controls defined per project. The controls below under Southwind Books describe that product.
On your server. Southwind Books and custom systems can be installed on your own server. The program is not exposed directly to the public internet; people reach it through your private network or VPN.
On our hosting. Websites, booking systems and hosted programs are served through Cloudflare, with encrypted connections. Each client's data is kept separate.
Southwind Books: who can see what
Every person has their own login, and every login has its own permissions.
- A company login only sees that company.
- Bookkeepers only see the companies assigned to them.
- The owner sees everything and controls who has access.
- Permissions are checked on each screen and each action, in addition to sign-in.
Southwind Books: logins and passwords
- In Viper Systems applications, passwords are stored as one-way hashes. Nobody can read them, including us.
- Optional two-step sign-in with a code from an authenticator app.
- Accounts lock after five failed attempts.
- Sessions end automatically after a period of inactivity.
- The owner can switch off any login immediately.
Encryption
Connections between a computer and the program are encrypted. Backups are encrypted before they leave your server.
Backups
- A full backup every night, kept on your server for 30 days.
- An encrypted copy stored off-site, so a fire, theft or ransomware attack doesn't take your records with it.
- A backup is taken automatically before each update.
Southwind Books: audit trail
In Southwind Books, every sign-in, entry, change and export is recorded with the person's name and the time. Entries in the books are not deleted; a correction is recorded as a new entry that reverses the old one, and the history is kept in full.
Updates
Security fixes are released as soon as they're ready. Updates are installed on a date you choose, outside your month-end, and each update can be rolled back.
Our access
On a system installed on your server, we have no access unless you give it to us. When you need support, you decide how we connect and for how long. On hosted systems, we only access your data to provide support you ask for. Our actions inside an application are recorded in that application's audit trail.
Vulnerability disclosure
To report a security problem in any Viper Systems software, email support@vipersystemsllc.com with the product name, a description of the problem and the steps to reproduce it. Do not include customer data, passwords or backup files in a report. Reports are read by Viper Systems directly, and we aim to acknowledge them within one business day.