Technical and Organizational Measures in the ePouta Service

Last updated: 13.8.2025

1 Purpose

The technical and organizational measures (TOMs) describe the agreement between the data controller and the data processor on how to process personal data as stated in article 28 of the General Data Protection Regulation (EU) 2016/679. The Data Protection Act (1050/2019) stipulates the obligations on how to protect special categories of personal data. On behalf of the partner organization, CSC – IT Center for Science Ltd. (“CSC“) processes personal data, where the partner organization acts as a data controller, to produce the services agreed in the service contract. The measures taken to protect this data by CSC when producing the ePouta service.

The data processor can unilaterally change the protective measures without notification when the changes retain or improve the general level of protection. Single protective actions can be replaced as long as it doesn’t affect the level of protection regarding personal data. CSC can make changes to this document when the protective measures are changed. Pertinent changes are reported to the data controller.

2 Protective Measures in the ePouta service

CSC – IT Center for Science Ltd. is committed to ensuring the protection of personal data processed within the ePouta Infrastructure Cloud service. These TOMs are part of the contractual obligations between the controller and CSC, in compliance with the GDPR (EU) 2016/679 and Finnish Data Protection Act (1050/2018).

General Principles

• Segregation of Duties:
  Administrative responsibilities are divided among network, data center, storage administrators and cloud system administrators to minimize risk.
• User Terms of Use:
  Users must agree to CSC’s Terms of Use and the specific ePouta terms of use before accessing the service environment.
• Secret Management:
  The use of Administration-level credentials is kept to the bare  minimum. Administrators follow internal guidelines on secret management.
• Layered Security Architecture:
  User access and system administration interfaces are segregated within secure network zones and protected by firewalls. The administration interfaces are separated from administration interfaces for other services.
• Contractual Basis:
  All data processing operations are based on written agreements with the data controller.
• Role-based Access Control:
  Access rights are allocated according to roles and follow the principle of least privilege. CSC maintains its staff’s access rights, ensuring they are limited to tasks that require access.
• Access Management:
  Data controller retains control over its own staff’s access rights. All administrators who have access to ePouta have gone through background checks.
• Training and Awareness:
  CSC personnel receive continuous data protection and security training. Training records are maintained internally. Administrators are trained for additional service specific instructions.
• Confidentiality Obligations:
  All personnel handling personal data are bound by confidentiality agreements and comply with applicable data protection laws (such as the Finnish Act 1050/2018).
• Data Protection Officer:
  CSC has appointed a dedicated Data Protection Officer (DPO) to oversee data protection compliance.
• Data Storage Location:
  All data is stored within the EU (Finland).

Measures to Ensure Confidentiality

• Network Protection: 
  The service interfaces are not open to the internet. Users need to specifically request the service to be to be opened to their network ranges. Before the use of the service, a dedicated network connection is set up to the users home organization. All traffic to and from the users virtual machines go via the users’ home organization networks. The data flowing through the dedicated network connection is not encrypted by default unless agreed on separately. Customers’ networks are segregated from each other and the administration networks. 
• Data Encryption:
  All communication towards the ePouta service is encrypted. By default only SSH key authentication is enabled towards users’ virtual machines. The users are recommended to only use encrypted communication towards the virtual machines they control.
• Multi-Factor Authentication (MFA):
  All web-based logins to CSC services require multi-factor authentication (MFA), providing an additional layer of security beyond username and password.
• Multi-tenant design:
  The resources of all projects (virtual machines, storage, network) are isolated from each other. Only project members can create, access, remove or modify resources within the project. Volumes may be transferred to other projects.
• Access Control:
  Session reuse is disabled when authenticating to the ePouta service. Even if a user has logged into another CSC service, users need to re-authenticate to ePouta. By default only SSH key based access for the user specified SSH key  is available for any new virtual machines the users create. Administrators of the ePouta service can not log into the users virtual machines.
• Data Ownership:
  The virtual machine and volume data is stored in a way that administrators are able to access it on the underlying storage systems. This data is only accessed on user request. If the user wants to ensure administrators have no access to this data, they should use filesystem encryption on the virtual machine disks. CSC does not return broken disks to the vendors. All disks that have had customer data go through a secure destruction process.

Measure to Ensure Integrity

• Data Integrity:
  Virtual Machine data are stored in different places depending on the characteristics of the virtual machine. The documentation clarifies the risk to different virtual machine flavors. The data stored on the central storage system (including volumes) is stored in a redundant fashion and is safe from multiple simultaneous failures. The data stored on the central storage system is also automatically periodically validated, to prevent corruption. Backups are not automatically taken of the users’ virtual machines or data, and backups are the responsibility of the user.
• Service integrity:
  The service deployment is automated, and all changes are verified in test systems, and deployed using automation. Formal change management processes are followed when making changes. All production changes are reviewed before they are deployed.
• Vulnerability management:
  The Services are being regularly scanned for vulnerabilities and other weaknesses. This means that CSC internal security team will scan the Services regularly in order to verify no unspecified network services or ports are available, and that no known vulnerabilities exist on the Services.
  Software vulnerabilities are tracked, evaluated and patched daily.

Measures to Ensure Availability and Resilience

• Automatic Monitoring:
  CSC uses automated monitoring systems to detect and report service disruptions or anomalies to administrators.
• Disaster Recovery & Backup:
  All system configuration is automated, versioned and easily redeployable. The service data is backed up, to ensure the service can be restored in case of failure.
• User Data Backup Policy:
  User virtual machines or volume data are not backed up.
• Redundancy:
  Most of the components of the service – including power, networking and central storage –  are redundant to ensure that single component failure does not affect service availability. This also ensures that the majority of maintenance operations do not impact the users.
• User Account Synchronization:
  User accounts are automatically synchronized with CSC’s central user management system to maintain operational resilience.

Measures for Testing, Evaluation, and Assessment

• Audits & Compliance:
  CSC conducts regular internal and external audits, including ISO 27001 audits, to evaluate the effectiveness of security measures.
• Incident Management:
  Security incidents are managed according to defined operational processes, including analysis, response, and post-incident reviews.