About PANTHEON Security

This chapter provides an overview of the security policy for PANTHEON and its associated applications and services.
It explains which security mechanisms are integrated into the PANTHEON system and how these measures ensure reliable data protection and secure system usage.
The focus is on security elements that ensure user identity protection, data confidentiality and integrity, and secure system operations. The document describes how security is ensured at all levels – from application login, to data transmission encryption, and control over integration interfaces.

1. Security Framework of the PANTHEON System

1.1. Target Audience

This security document is intended for a broad range of users:

• End users of PANTHEON (for secure usage),

• System administrators (for technical configuration and control),

• Management and DPO (for compliance with security and legal requirements).

Advanced users who require more in-depth information and technical details are provided with additional resources and links to gain deeper insights into the implemented security mechanisms.

1.2. Connection with Information Protection Policy

These guidelines are part of Datalab's personal data protection policy and are compliant with regulations such as the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2), which provide the foundation for the proper collection, processing, and storage of personal and business data.
Security procedures also follow the framework defined by the ISO/IEC 27001 standard, which offers globally recognized guidelines for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).

1.3. Key Security elements

PANTHEON security is multi-layered and requires a comprehensive approach that spans multiple domains. These areas are essential to ensure data protection, operational continuity, and legal compliance.
The following key areas form the foundation for effective ERP environment protection:

1. Infrastructure and Environment
   Physical and virtual infrastructure is the foundation of the ERP system. Securing server equipment and data centers protects against unauthorized access and failures that could impact system availability.

2. Network and Connectivity
   Secure network connections prevent unauthorized access and eavesdropping during data transmission, which is critical for protecting sensitive ERP information.

3. Access and Authentication
   Proper user rights management and strong authentication ensure that only authorized individuals can access the system, reducing the risk of abuse.

4. Data Management
   Data is the core of the ERP system. Protecting it through encryption, backups, and proper access management ensures reliability, integrity, and confidentiality.

5. Updates and Maintenance
   Regular updates and maintenance address security vulnerabilities and ensure the system remains protected against emerging threats.

6. Legal Compliance
   Compliance with applicable laws and standards is essential for legal assurance and user trust, while also helping prevent financial and reputational damage.

7. Audit and Access Logging
   Detailed logging and monitoring of access enable detection of unauthorized activity and provide traceability for security audits.

8. Disaster Recovery and Business Continuity
   Recovery plans and business continuity measures ensure quick restoration after incidents and minimize downtime, which is vital for uninterrupted operations.

IMPORTANT This document is aligned with NIS 2 (Network and Information Security 2), the European Directive (EU) 2022/2555, which requires organizations – including ERP systems – to formally define and document their security (ICT) policy.

2. Security in PANTHEON

2.1. Basic Security Recommendations

PANTHEON ERP is designed with data security in mind. However, since it is an open system that allows extensive integration, customization, and connection with other solutions, it is essential that users follow basic safe usage practices.

2.2. Standards and Best Practices

In addition to vendor recommendations, the ISO/IEC 27001 standard is increasingly recognized for ensuring ERP security, as it defines best practices for information security management. It is also advisable to follow the OWASP Top 10 guidelines for web application development.

2.3. Security in the Development Lifecycle

An important aspect of ERP security is the integration of security into the entire software development lifecycle (Secure Development Lifecycle).
This includes incorporating security requirements during the planning phase and performing security activities at each stage of development, such as:

• code security reviews,

• using static code analysis tools,

• automated testing before deployment to production, etc.

2.4. Reliability Regardless of Deployment Type

PANTHEON ERP supports various deployment options (on-premise, cloud-based, hybrid), and is designed to ensure data security regardless of the chosen setup and external system integrations.

Hint The OWASP Top 10 is a list of the ten most common and dangerous web application security vulnerabilities. It is published by OWASP (Open Worldwide Application Security Project), a leading organization in application security. This list serves as a global standard for developers, security professionals, and companies to recognize and remediate critical security flaws.