Security

Requirements, specifications and test records are often confidential. This page describes how the Engineering Toolbox Requirements Manager (ETRM) protects your data.

Based on OWASP ASVS

Development follows the security standard OWASP ASVS (Application Security Verification Standard); the target is Level 2. There is no certification. The ASVS is a freely available catalogue of requirements for web application security published by the OWASP Foundation.

Encrypted transmission

ETRM is only accessible via HTTPS. All data between your browser or your scripts and ETRM is transmitted in encrypted form.

Access for project members only

Projects belong to a group. Only members of that group can see the contents, images and attachments of a project, and every action depends on the member's role (read, comment, edit, administer). The project is not visible to anyone else. Details are given under Roles and permissions.

Traceable changes

Every change to an artifact is recorded with date and person, as are links, images, tags and module membership. Earlier versions of an artifact remain visible and can be restored. Security-relevant events are logged.

Protected sign-in

Passwords are not stored in plain text, only as a hash. Repeated failed sign-in attempts and automated access are detected and slowed down. Password reset links are only valid for a limited time and can only be used once.

API access keys

Keys for the REST API are shown only once when created and are then stored exclusively as a hash. You can revoke a key at any time and restrict it to read access.

No third-party analytics or tracking services

No third-party analytics or tracking services run in ETRM, and only technically necessary cookies are set. Our own purely numerical evaluations, such as how often pages are accessed or advertising banners are displayed, take place on our server without IP addresses, without cookies and without reference to persons. Fonts and scripts come from our own server; third-party content is only loaded where it is needed: for payment via Stripe and for videos in the help after your click.

Data backup

The database and uploaded files are backed up daily.

Payment data

Payments are processed by the payment provider Stripe. Credit card and account details are entered directly with Stripe and are not stored in ETRM.

Reporting security issues

If you notice a possible security vulnerability, please contact us using the details in the Legal disclosure (link at the bottom of every page) and do not publish the issue before we have been able to review it. We will reply as quickly as possible.