Technical and Organizational Measures in the Allas Service

Last updated: 20.10.2025

1 Purpose

The technical and organizational measures (TOMs) describe the agreement between the data controller and the data processor on how to process personal data as stated in article 28 of the General Data Protection Regulation (EU) 2016/679. The Data Protection Act (1050/2019) stipulates the obligations on how to protect special categories of personal data. On behalf of the partner organization, CSC – IT Center for Science Ltd. (“CSC“) processes personal data, where the partner organization acts as a data controller, to produce the services agreed in the service contract. The measures taken to protect this data by CSC when producing the Allas service.

The data processor can unilaterally change the protective measures without notification when the changes retain or improve the general level of protection. Single protective actions can be replaced as long as it doesn’t affect the level of protection regarding personal data. CSC can make changes to this document when the protective measures are changed. Pertinent changes are reported to the data controller.

2 Protective Measures in the Allas service

CSC – IT Center for Science Ltd. is committed to ensuring the protection of personal data processed within the Allas object storage service. These TOMs are part of the contractual obligations between the controller and CSC, in compliance with the GDPR (EU) 2016/679 and Finnish Data Protection Act (1050/2018).

General Principles

• Segregation of Duties:
  Administrative responsibilities are divided among network, data center, storage administrators and cloud system administrators to minimize risk.
• User Terms of Use:
  Users must agree to CSC’s Terms of Use and the specific Allas terms of use before accessing the service environment.
• Secret Management:
  The use of Administration-level credentials is kept to the bare minimum. Administrators follow internal guidelines on secret management.
• Layered Security Architecture:
  User access and system administration interfaces are segregated within secure network zones and protected by firewalls. The administration interfaces are separated from administration interfaces for other services.
• Contractual Basis:
  All data processing operations are based on written agreements with the data controller.
• Role-based Access Control:
  Access rights are allocated according to roles and follow the principle of least privilege. CSC maintains its staff’s access rights, ensuring they are limited to tasks that require access.
• Access Management:
  Data controller retains control over its own staff’s access rights. All administrators who have access to Allas have gone through background checks.
• Training and Awareness:
  CSC personnel receive continuous data protection and security training. Training records are maintained internally. Administrators are trained for additional service specific instructions.
• Confidentiality Obligations:
  All personnel handling personal data are bound by confidentiality agreements and comply with applicable data protection laws (such as the Finnish Act 1050/2018 Tietosuojalaki).
• Data Protection Officer:
  CSC has appointed a dedicated Data Protection Officer (DPO) to oversee data protection compliance. See https://www.csc.fi/en/privacy for more information and contact details
• Data Storage Location:
  All data is stored within the EU (Finland).

Measures to Ensure Confidentiality

• Network Protection: 
  Firewalls protect the service and only necessary ports and protocols are available to the public.
• Transport Encryption:
  All communication towards the Allas service is encrypted.  Allas only supports connections secured with TLS1.2 or higher and only uses OV (Organization Validated) certificates that identify CSC as the organization.
• Project separation
  By default, projects have no access to each other’s data and separate access tokens are used for each project. Access to tokens depends on project membership, that the owner of the project can manage in My CSC. All members of a project have full access to data stored for that project.
• Physical and administrative access:
  The data in buckets is stored in a way that administrators are able to access it on the underlying storage systems. Data is only accessed on user request. If the user wants to ensure administrators have no access to what’s in the data, they should encrypt it before uploading to Allas. Storage media that holds customer data, once removed from Allas, goes through a secure destruction process and is never sent to be refurbished or serviced.

Measure to Ensure Integrity

• Integrity of data at rest:
  Allas protects the data from storage media failures using an error correction scheme, through spreading the data in chunks over a large number of storage media, and regularly scrubbing the data for early detection and correction of storage problems.
• Integrity of data in transit:
  Allas protects the integrity of data during transit by encrypting the data in a way that fails to decrypt if altered. When uploading data, Allas allows the user to send a precalculated MD5 checksum of the data, that is verified and must match the data for the upload to be accepted.
• Service integrity:
  The service deployment is mostly automated, and all changes are verified in test systems before entering production. Formal change management processes are followed when making changes. All production changes are reviewed before they are deployed.
• Vulnerability management:
  The Services are being regularly scanned for vulnerabilities and other weaknesses. This means that CSC internal security team will scan the Services regularly in order to verify no unspecified network services or ports are available, and that no known vulnerabilities exist on the Services. Software vulnerabilities are tracked, evaluated and patched regularly.

Measures to Ensure Availability and Resilience

• Automatic Monitoring:
  CSC uses automated monitoring systems to detect and report service disruptions or anomalies to administrators.
• Disaster Recovery & Backup:
  All system configuration is automated, versioned and easily redeployable. The service system data is backed up to ensure the service can be restored in case of failure.
• User Data Backup Policy:
  User data is not in the scope of our backups. Users are responsible for backups of their data.
• Redundancy:
  Most  of the components of the service – including power, networking and storage – are redundant to minimize the effect that single component failures would have on service availability. This also ensures that the most maintenance operations have no impact on the users.
• User Account Synchronization:
  User accounts are automatically synchronized with CSC’s central user management system to maintain operational resilience.

Measures for Testing, Evaluation, and Assessment

• Audits & Compliance:
  CSC conducts regular internal audits to evaluate the effectiveness of security measures.
• Incident Management:
  Security incidents are managed according to defined operational processes, including analysis, response, and post-incident reviews.