Our software solutions leverage the best tools and technologies such as TLS and VPN used in securing the transfer of data through a network from source to the destination. We have excellent mechanisms and systems in place to ensure our client’s data remains private and protected and be accessible only by authorised entities, as required under the DPA and UK GDPR.

An application level security is implemented to make sure authorised entities will be able to access the platform based on user permissions and roles assigned to them. So a user can only access data for which they have permissions for.

We understand that the data should only be utilized for the purpose for which is it meant, which is why we are always transparent with our clients in this regard. We also make sure that data is encrypted with our highly sophisticated encryption algorithms which a combination of the Advanced Encryption Standards (AES) and the RSA Encryption algorithms.

This ensures a strong security system that adheres to the GDPR standards. This AES algorithm is extremely efficient in 128-bit form and uses keys of 192 and 256 bits for heavy-duty encryption and the RSA is refer to as the asymmetric encryption algorithm because it uses a pair of keys.

The public key is used to encrypt a message and a private key to decrypt it. There is also an audit trail log system in place to ensure that all users’ activities within the network are captured. This will be essential to understand transactions done on the network and to provide digital evidence formally required by GDPR.

All data is stored and processed in central database servers and repos deployed in the United Kingdom of Great Britain and Northern Ireland. We also ensure that these databases are well secured by making sure the following is in place:

1. Setting up permission and user roles. Privileges will be granted based on defined in corporate directories. For example, a database administrator will be granted permissions for all database servers whereas a web administrator user would not need to have access such roles.

2. Once roles and permissions are defined. The users of the systems must always authenticate before logging into the platform. This could be done by assigning users a username and strong password and with the use of tokens.

3. Since users’ locations are identifiable from the IP address of their devices, we will put checks in place to restrict access from other locations. Restrictions can also be made on type of access users have when using the virtual private network (VPN)

To avoid downtime of system, backups of the systems is always conducted to ensure that data is available in case of a system failure or data corruption. To achieve this data is replicate to what is known as fail-over servers. This ensures that the entire network of system is distributed. In case one server is down there is a seamless continuation of operations from another server within the network.

In terms of the personal compliance of individual rights of the DPA, we operate a fully comprehensive system that provides for the compliance of each of the follows areas:

1. Right to be informed: All site visitors and clients are given full information on how their data may be used and processed, with the immediate right to opt out of this. This is done through our policies outlined for new visitors to our websites, and for those with whom we engage with outside of our webspace, this is issued to them prior to any aspect of formal communication.

2. Right of access: All those with whom we have engaged in any form of communication or data processing, have the right under a subject access request to access their data. The process for this is outlined very clearly through our online terms and conditions and in the publicising of Mr. Richard Vernon has the designated data control officer. When a request occurs, this is dealt with in a timely manner.

3. Right to rectification: We know how and have a formal policy process for the rectification of incorrect data, to ensure that it is corrected in a timely and efficient manner.

4. Right to erasure: All clients can permanently delete any of their profiles with ourselves. We have a policy in place to ensure that any requests for erasure are dealt with within a one-month period.

5. Right to restrict data: We have in place a secure storage facility, as outlined above under encryption, that allows the storage of data from which clients have told us not to delete, but rather to restrict it. A process is in place when such a request occurs.

6. Right of portability: Client data held can be automatically transferred to a csv format at the request of the client, and as such has portability.

7. Right to object: We have in place a full process for the swift processing of the objections of individuals for the processing of their personal data. In addition, our website has full functionality, to opt in and to opt out of separate aspects of support, or direct messaging. Right to object requests are taken seriously and have a full process outlined to ensure satisfactory and swift outcomes.

8. Right related to automatic profiling: This is used only necessary for the entry into or performance of a contract; or authorised by domestic law applicable to us; or based on the individual’s/client’s explicit consent. Where this is done, we have given all clients information about the processing and have introduced simple ways for them to request human intervention or challenge a decision and we carry out regular checks to make sure that your systems are working as intended.

GSS has complex involvements, both internally between departments and externally with partner services and agencies. Some of the fundamental functions of the company rely on the safe and secure transfer of information between internal departments and external partners/agencies.

The foundation of this transfer is based upon the available facilities that can be used in a timely and secure fashion, dependent upon the classification of the data in the transfer.

The secure file transfer facilities provide the appropriate mechanism by which the information, of any type or classification, can safely and securely by transferred as and when required within the GSS and between external partners/agencies.  

Emails   sent   from   one   of   the “graduateschemesuccess.co.uk” accounts   to   another “graduateschemesuccess.co.uk” account, are encrypted and deemed secure for file transfer of any classification (public, controlled or restricted).

When sending to a team/generic email account, our policy is that this must be checked that all persons with access to the team email address are authorised to view any attached files.

Delegate access is reviewed to ensure delegates are authorised to view files. If delegate access is not authorised any email with attached files are saved to a secure network location.

Emails classified as ‘restricted’ are not sent to distribution lists unless everyone in the distribution list is authorised to access information included in the email. Emails sent from a graduateschemesuccess.co.uk email address to a non-registered safe email address, are deemed insecure because they do not stay within the email system and are only used to transfer documents/files that are classified as ‘Public’. ​

Graduate Scheme Success has secure data transfer availability, using encryption services, and secure transfer services software. This software platform meets the latest transfer security standards, using Transfer Layer Security and Virtual Private Network capabilities. It is develop leveraging the 3 cipher suites, all with the perfect forward secrecy (PFS), authentication encryption and additional data (AEAD), and modern algorithms.

With TLS 1.3 integrated in this software this means that content hiding is enabled by a minimal set of clear text protocol bits. As a result, less user information is visible of the network and hence we are guarantee that maximum privacy and security in terms of data transfer will be in place.

With the VPN integration in the software, we are sure to anonymize or online presence. What this simply means is that the actual IP address which provides information of your location and device on the network is masked with a different IP address to the outside making it impossible for intruders to identify the IP address assigned to a network computer or device. This allows for safe transfer of data without the risks of been hijacked by some unauthorised persons.

All those within the authority staff, of whom communication is regularly required, will be added to a safe list of recipients for the receipt of encrypted emails. Each application candidate will have access to a secure online portal, which allows personalised communication with their dedicated support manager.

Access to this portal is secured through two factor authentication, thus providing a level of assurance that access is only available to that individual, and as such all communications remain secure. In the figure 1 below we describe the architecture of our proposed software platform.

The devices is where the software will be installed. With the use of APIs we will able to channel any data leaving a network device to the TLS and VPN client module to first encrypt and secured this data before sending it to the recipient via internet connectivity.      

Figure 1: Architecture of proposed software application for data transfer