Skip to main content

7. Operational Security and Infrastructure Protection

7.1 Hosting and Maintenance​

In case OpenRemote is requested to host the Software as a service, the sales manager agrees on a service and maintenance contract which covers both hosting as well as maintenance activities.

When hosting the production environment, the environment is actively monitored and a communication channel is agreed with the customer for support. The development environments, including a test or staging environment remain available, in case maintenance activities are required.

Service requests (bugs and issues) are reviewed by the sales and account manager, judging coverage and severity level. Together with support manager he plans follow up as part of project realisation. Preventive maintenance, based on new software releases of OpenRemote or 3rd party software, are planned in conjunction with product development, if part of the service agreement.

7.2 Data Security and Privacy​

We maintain a living document around data security and privacy, intended to regularly perform an internal audit or one with customers to validate our performance regarding data security and privacy. See Data Security (restriceted access).

7.3 Identity and Access Management​

Access to organisational systems and services is granted based on defined roles and responsibilities. Access rights are limited to the permissions required to perform assigned tasks.

Access is reviewed periodically, as part of data security and privacy, to ensure that permissions remain appropriate and that accounts belonging to former employees or contributors are removed.

7.4 Logging and Monitoring​

Operational systems and infrastructure components generate logs that provide visibility into system activity. Monitoring tools are used to detect anomalies, performance issues, or potential security incidents.

Logs are retained for a defined period and reviewed when necessary to support operational monitoring or incident investigations.

7.5 Change Management​

Changes to infrastructure, software, or operational processes are tested when appropriate to minimise disruption to services.

Records of significant changes are maintained to support traceability and operational review, by saving GitHub history, and releases of code, documentation and handbook.