Platform security and compliance
Where your data is, who can see it, and why the separation between clients is not a promise but a structure. The answers you also need for supplier questionnaires.
You hand us the map of your weak points: you are right to ask how we treat it
Giving a supplier the data on your own vulnerabilities means entrusting it with very sensitive information. That is why Dottor Box is designed so that the security of clients' data depends on the architecture, not on good intentions.
Every company has a database separate from the others. Access always requires a second factor. On your Microsoft and Google environments the platform reads and does not change anything. And the company providing all this is ISO/IEC 27001 and ISO 9001 certified, subject to the same controls it asks you to adopt.
A database for each client, not a shared column
Many multi-client platforms separate data with an application filter: one badly written query is enough to mix it up. Not Dottor Box.
Dedicated schema
Each Dottor Box has its own database schema, identified by a unique code. They are separate databases, not filtered rows of a shared table.
Authorised switching
On every request the application connects to the active client's schema, and only if the user has a valid authorisation on that Dottor Box.
Files are separate too
Compliance documents, attachments and company letterheads live in a folder dedicated to each client.
Infrastructure, GDPR and artificial intelligence
The analysis system runs in the cloud on Google cloud infrastructure and Dottor Marc's own data centres. Processing is set up for GDPR compliance and Dottor Marc has appointed a Data Protection Officer (DPO).
The artificial intelligence features, such as draft procedures, evidence checks and suggested audit checklists, run on a private model installed on controlled infrastructure. None of your documents is sent to public AI services, and what the AI produces always remains a proposal that a person approves.
Retention
All the data collected is available in the platform for the duration of the contract, for a maximum period of 2 years: enough to cover a full certification cycle. The Time Machine gives quick access to the last 180 days.
When the contract ends, access is closed, including downloading reports: if you want to keep them, download them before the expiry date.
Who gets in, and how
- Mandatory two-step verification (TOTP with an authenticator app) across the whole client area
- Single sign-on with Microsoft Entra ID and Google Workspace, configurable per client; it counts as the second factor
- Allowed domains and mapping between company groups and roles
- Three authorisation levels for each Dottor Box
- Email address confirmation before the first login
- Every login attempt is recorded, successful or failed
- Rate limits on login, second factor, registration and password reset
- Integration secrets and credentials encrypted at rest, never displayed or written to logs
- The password you choose when you first log in is encrypted and not accessible even to Dottor Marc
How the platform talks to your systems
Each channel has a specific purpose and a stated protection.
| Channel | What it is for | How it is protected |
|---|---|---|
| Cyber Drill probe → platform | Sending internal scan results | The probe makes the call: no inbound ports on your firewall; commands are encrypted with a client-specific key |
| External scanner | External network and web application scanning | Filtering on authorised IP addresses and rate limits |
| Microsoft 365 tenant | Security posture and sign-ins | Read-only. An account is disabled only when a person confirms it |
| Google Workspace | Security posture | Service account with read scopes; the platform only performs reads |
| Google Drive | Suggesting processing activities for the records of processing | Metadata only: folder names and structure, never the content of files |
Simulated attacks, authorised in writing
Dottor Box does not just look: to test security it carries out simulated attacks, with automated tools and manual techniques, always within the limits of a security test. That is why the contract contains the client's explicit authorisation.
Scans are designed to be non-invasive, and you can exclude individual addresses, ports or devices.
A status page outside the platform
The status.dottorbox.it page runs on infrastructure separate from the application: you can check the service status even when the service itself is not responding. Incidents follow a stated cycle: Identified → Investigating → Monitoring → Resolved.
It is also how we apply to ourselves the control that ISO/IEC 27017 asks of cloud service providers.
Dottor Marc is ISO/IEC 27001 and ISO 9001 certified
The same controls we ask of you
The company providing the service has a security management system certified by an independent body, with regular audits.
An answer for questionnaires
When one of your customers qualifies you as a supplier and asks whether your ICT suppliers are certified, the answer is documented.
Evidence for your supply chain
It is the supply chain requirement that NIS2, ISO 27001 and DORA ask of you too.
Personal data in the contract. Dottor Marc processes the data collected as controller for the performance of the contract, does not disclose it to third parties and is bound by a mutual confidentiality obligation. The DPO is available for any request, including the list of processors. Details on the How it works page.
Do you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.