Security
Explore our certificates, compliance, resources and frequently asked questions.
1. Introduction
Centra is committed to prioritizing security through building information security culture across the whole organization and following established security and privacy standards that guarantee confidentiality, integrity, and availability of information and our products.
2. Certifications
ISO 27001:2022 Information security, cybersecurity and privacy protection — Information security management systems — Requirements
Centra operates a certified Information Security Management System (ISMS) compliant with ISO 27001:2022 standard. Our ISMS covers all locations and processes in the organization. The certification of the ISMS is done by TUV Nord.
Find an ISO 27001:2022 Certificate Find an ISO 27001:2022 Statement of Applicability Find an ISMS Information Security Policy
3. Compliance
As a global company with the headquarter in the EU Centra has to comply with different national regulations concerning privacy and security. Some of these regulations are listed below.
(EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) - GDPR
As an EU company we comply with the GDPR regulation. We have implemented the ISO27001-compliant ISMS to ensure the protection of personal data at any stage of its processing.
4. Resources
Below you can find some publicly available information security or privacy resources. If you cannot find what you are looking for please contact us directly.
ISO 27001:2022 Certificate
An up-to-date certificate of our Information Security Management System compliant with ISO 27001:2002 standard.
ISO 27001:2022 Statement of Applicability
A list of information security controls listed in the Annex A of ISO 27001:2022 with the implementation statement. You can use this resource to understand the technical and organizational measures (TOMs) that are implemented by Centra.
ISO 27001:2022 Statement of Applicability
ISMS Information Security Policy
An entry level policy describing on the high level Centra’s Information Security Management System. You can use this policy to understand our ISMS setup in the organization.
ISMS Information Security Policy
Centra Platform Privacy Policy
A policy describing our approach to managing privacy of personal data on the Centra platform. You can use this policy to understand your rights as an individual (data subject) or the split of responsibilities for privacy between a data controller and a processor of personal data.
ISMS Centra Platform Privacy Policy
How is customer data protected and stored?
We use industry-standard encryption protocols to protect customer data both at rest and in transit. Data is stored in secure, ISO-certified data centers with robust physical and technical safeguards. Access to data is tightly controlled using role-based access permissions and multi-factor authentication (MFA).
Do you comply with standards like ISO 27001 or GDPR?
Yes, we comply with globally recognized standards and regulations, including ISO 27001 and GDPR, ensuring your data is handled securely and in compliance with privacy regulations. Regular audits of the Information Security Management System are performed by TUV Nord, as a notified body, to maintain our ISO 27001 certification. We also fulfill requirements defined in the GDPR regulation.
What measures are in place to prevent unauthorized access (e.g., MFA, SSO)?
We enforce strong access controls, including support for multi-factor authentication (MFA) and single sign-on (SSO) to protect accounts from unauthorized access. All access requests are logged and monitored for anomalies. Permissions are granted using the principle of least privilege, ensuring users only access what they need.
How do you encrypt data in transit and at rest?
All data in transit is encrypted using TLS 1.2 or higher to prevent interception during communication. Data at rest is encrypted using e.g. AES-256 or other secure encryption standards recommended by NIST. This ensures that even in the unlikely event of unauthorized access, your data remains secured.
What is your incident response process in case of a breach?
We have a structured incident response plan in place, including immediate containment, root cause analysis, and resolution. Affected customers are notified within a maximum 36 hours of discovering any privacy breach, as required by GDPR. Our incident response team conducts post-incident reviews to implement measures that prevent recurrence.
What is your backup and disaster recovery plan?
Every hour (Recovery Point Objective=1h) we perform backups of the Centra platform and store them securely in geographically redundant locations. Our disaster recovery plan ensures minimal downtime, with a recovery time objective (RTO) of under 24 hours. Regular backup restoration tests are conducted to validate the effectiveness of our recovery processes.
Do you perform regular vulnerability assessments and penetration testing?
Yes, we conduct routine vulnerability scans of Software Bill of Materials (SBOM) and regular penetration tests to identify and mitigate security risks. Independent security firms are engaged to validate our systems against the latest threats. Findings are promptly addressed, and customers are informed of any updates that enhance security.
Where are your data centers located, and are they secure?
Our data centers are located in ISO 27001-certified facilities within the European Economic Area (EEA) and comply with GDPR requirements. These facilities have 24/7 monitoring, biometric access controls, and redundant power systems to ensure physical and operational security. We provide data residency options for specific regulatory needs.
What security responsibilities do customers have when using your platform?
While we secure the Centra platform, customers are responsible for managing the frontend component, user access, creating strong passwords, and maintaining endpoint security. We recommend enabling multi-factor authentication and single sign-on and limiting administrative privileges to essential personnel. Following our security best practices ensures the highest level of protection.
6. Security contact
For any security related questions or information please contact us at security@centra.com.