Business Continuity and Disaster Recovery Guidelines for Datalab Cloud

At Datalab, we are committed to ensuring uninterrupted business operations for our users. To achieve this, we have established clear Business Continuity (BC) and Disaster Recovery (DR) policies, which are crucial for the smooth operation of your services in the event of disasters or unforeseen events. In collaboration with our partner Mainstream, we ensure a robust infrastructure that allows for quick recovery and minimal data loss.

1. Key Objectives: RTO and RPO

To ensure seamless business operations, the following objectives are set:

• RTO (Recovery Time Objective): The maximum time allowed for system recovery after an event. For our services, the goal is to restore all services within 24 hours. For critical services, such as access to business applications, the RTO is reduced to 6 hours.

1.1. RPO (Recovery Point Objective)

In accordance with the requirements of the ISO/IEC 27001 standard, the RPO for information systems is set to 24 hours.

Backups are performed every night, ensuring that in the event of a security incident, failure, or disaster, the maximum possible data loss is limited to no more than 24 hours.

This value is based on a risk assessment, business requirements, and an established and monitored backup process.

For customers who order their own virtual environment (dedicated virtual infrastructure), where multiple databases of the same client are hosted on one server, the RPO can be further reduced.

In such cases, the RPO is determined individually based on the technical design of the environment and client's requirements.

Example: For dedicated virtual environments, an RPO of 4 hours can be set, meaning the maximum allowable data loss is limited to no more than 4 hours before the incident occurs.

2. BC and DR Strategy

In collaboration with Mainstream, we ensure a strategy that includes the following key components:

• Geographic Redundancy of Data Centers: Data is stored in two independent data centers, providing resilience against local issues such as power outages, floods, or fires.
• Backup Solutions: All services are protected with the Veeam Backup solution, which allows for daily, weekly, and monthly backups. Data is always available for restoration in case of errors or outages.
• DR Plan: The recovery plan for disasters includes procedures for quickly restoring applications and data, using the latest technologies and multi-tier backups to minimize downtime.

3. Security Procedures Responsibility

3.1. Mainstream Cloud Provider

The Mainstream Cloud Provider is responsible for the core cloud infrastructure. This includes the security of the cloud infrastructure, physical security of data centers, network infrastructure, and management of the basic infrastructure components (virtual servers, operating systems, networks). It also ensures encryption of data at the infrastructure level, performs backups, and collaborates in ensuring compliance with GDPR within its infrastructure.

3.2. Datalab (Provider – Processor)

Datalab is responsible for the development, operation, and security of the applications running on the cloud infrastructure. This includes the development of applications, their maintenance, ensuring availability and performance, and implementing security updates and protection against attacks. Datalab also collaborates in data management, user account management, data encryption, ensuring GDPR compliance, and handling individual requests (DSAR), but always within the guidelines and purposes set by the client.

3.3. End Customer (Data Controller)

The client as the data controller is responsible for the content of the data and the purpose and means of processing personal data. This means the client decides which data is processed, why, and how. The client is responsible for the data entered by users, business rules for managing data and user accounts, and responding to individuals’ requests concerning their rights (DSAR). Additionally, the client bears the ultimate responsibility for GDPR compliance regarding the legality of processing.

4. Regular Testing and Readiness Checks

In line with best practices for BC, we conduct the following:

• Regular Simulations and Tests: Every 6 months, we perform recovery tests, simulating various scenarios to check how quickly we can restore data and services.
• Audits: At the request of the customer, system audits and security procedure checks can be conducted to ensure compliance with internal security policies and international standards.

5. Communication Security

To ensure secure and encrypted communication between users and our services, we provide:

• HTTPS Connection: All connections between users and our applications are encrypted using the HTTPS protocol to secure data transmission.
• VPN Access: For additional security, VPN connections are available, allowing users to securely connect to our servers. Multi-Factor Authentication (MFA) is available for additional protection when accessing sensitive information.

6. DR and Timeframes

In the case of significant disasters, such as server infrastructure failures or attacks, we can restore data within the following timeframes:

• Virtual Infrastructure Recovery: Time to restore virtual machines and SQL servers is 3 to 6 hours during business hours.
• Data Recovery from Backups: Time to restore data from backups is estimated at 3 to 5 hours, depending on the scope and complexity of the recovery.
• Data Availability: All backups are available in multiple copies for different time periods (daily, weekly, monthly).

7. Security and Protection Against Attacks

To protect our infrastructure and user data, we have implemented the following security measures:

• Penetration Testing: We regularly conduct penetration tests as part of our security assurance activities for the cloud infrastructure and hosted (Cloud) environments used to deliver our services. The testing is performed by independent third-party security providers, ensuring objectivity and adherence to industry best practices. Testing is conducted periodically, typically annually; however, we are currently implementing an automated penetration testing platform that will enable more frequent and continuous testing in the future. This platform will also be available to our customers as an additional service.
• Vulnerability Management: We regularly perform vulnerability scans on our systems and hosted environments. Vulnerability assessments are conducted at least monthly, and more frequently when necessary. We track, manage, and remediate identified vulnerabilities through our internal vulnerability management process, with remediation activities integrated into the regular operations of our technical teams.
• Compliance Statement: All activities related to penetration testing and vulnerability scanning are part of our security program, which is compliant with the requirements of ISO/IEC 27001:2022. Statement of compliance can be issued upon request.

8. Conclusion

Datalab Cloud provides a secure and stable environment for your data, with clearly defined BC and DR processes. Our policy for ensuring uninterrupted business operations enables fast recovery of services and data, reduces risks of business downtime, and provides high levels of data protection in the event of disasters.

This information will be publicly available on our UserSite, ensuring that our customers, are always informed about our practices and procedures for ensuring BC.

9. Compliance with ISO 27000 Security Policy

All of the aforementioned policies for Business Continuity (BC) and Disaster Recovery (DR) comply with the requirements of the ISO/IEC 27001 security framework, which sets out guidelines for protecting information systems, managing risks, and ensuring business continuity. All activities related to security procedures, such as backup, recovery, and DR, are carefully planned and executed in accordance with the principles of ISO/IEC 27001 and are regularly monitored through internal and external audits to ensure compliance with security standards.

All activities related to vulnerability management and penetration testing are included in our security program and are performed in accordance with the requirements of ISO/IEC 27001:2022. In accordance with our security and confidentiality policies, statements of compliance are also available upon request.

​