Technical and Organizational Measures in the Pukki Service

Last updated: 6.10.2026

1 Purpose

The technical and organizational measures (TOMs) describe the agreement between the data controller and the data processor on how to process personal data as stated in article 28 of the General Data Protection Regulation (EU) 2016/679. The Data Protection Act (1050/2019) stipulates the obligations on how to protect special categories of personal data. CSC – IT Center for Science Ltd. (“CSC”) processes personal data on behalf of the controller to produce the services agreed in the Service Agreement. The measures taken to protect this data by CSC when producing the Pukki (DBaaS) service are listed below.

The data processor can unilaterally change the protective measures without notification when the changes retain or improve the general level of protection. Single protective actions can be replaced as long as it doesn’t affect the level of protection regarding personal data. CSC can make changes to this document when the protective measures are changed. Pertinent changes are reported to the data controller.

2 Protective Measures in the Pukki service

General Principles 

• Segregation of Duties:
  Administrative responsibilities are divided among network, data center, storage administrators and cloud system administrators to minimize risk.
• User Terms of Use:
  Users must agree to CSC’s Terms of Use before accessing the service environment.
• Secret Management:
  The use of Administration-level credentials is kept to the bare minimum. Administrators follow internal guidelines on secret management.
• Layered Security Architecture:
  User access and system administration interfaces are segregated within secure network zones and protected by firewalls. The administration interfaces are separated from administration interfaces for other services.
• Contractual Basis:
  All data processing operations are based on written agreements with the data controller.
• Role-based Access Control:
  Access rights are allocated according to roles and follow the principle of least privilege. CSC maintains its staff’s access rights, ensuring they are limited to tasks that require access.
• Access Management:
  Data controller retains control over its own staff’s access rights.
• Training and Awareness:
  CSC personnel receive continuous data protection and security training. Training records are maintained internally. Administrators are trained for additional service specific instructions.
• Confidentiality Obligations:
  All personnel handling personal data are bound by confidentiality agreements and comply with applicable data protection laws (such as the Finnish Act 1050/2018).
• Data Protection Officer:
  CSC has appointed a dedicated Data Protection Officer (DPO) to oversee data protection compliance.
• Data Storage Location:
  All data is stored within the EU (Finland). 

Measures to Ensure Confidentiality

• Network Protection: 
  Firewalls protect the service and only necessary ports and protocols are available to the public. Access towards the users’ resources is by default denied, and users must specifically allow sources for incoming traffic.
• Data Encryption:
  All communication with the Pukki service can be encrypted. It is possible for users to establish encrypted connections towards all their databases. Users’ databases and database backups are stored encrypted at rest and in transit.
• Multi-tenant design:
  The users’ databases are hosted on dedicated virtual machines to ensure a high degree of isolation. Only project members can create, access, remove, or modify resources within the project.
• Multi-Factor Authentication (MFA):
  All web-based logins to CSC services require multi-factor authentication (MFA), providing an additional layer of security beyond username and password.
• Access Control:
  Access control to the service is project specific and managed from my.csc.fi. The database users, roles, passwords, and firewall rules are managed by the users and are their responsibility. 
• Data Ownership:
  The users’ databases are stored on encrypted filesystems. The service administrators are able to access them, but will only do so on user request, or when responding to issues with the database. 

Measures to Ensure Integrity

• Data Integrity:
  All backups of users’ databases are tested to ensure they can successfully be restored into new databases. New backups are automatically created to replace those which fail the tests. The process is continuously improved as weaknesses in the tests are noticed. 
• Service integrity:
  The service deployment is automated, changes are verified in test systems and deployed using automation. All production changes are reviewed before they are deployed. 
• Vulnerability management:
  The Services are being regularly scanned for vulnerabilities and other weaknesses. This means that CSC’s internal security team will scan the Services regularly in order to verify no unspecified network services or ports are available, and that no known vulnerabilities exist on the Services. Software vulnerabilities are tracked, evaluated and patched on a daily basis when found. 
• Change Management:
  A formal change management process ensures all updates and changes are reviewed and implemented securely.

Measures to Ensure Availability and Resilience

• Automatic Monitoring:
  CSC uses automated monitoring systems to detect and report service disruptions or anomalies to administrators.
• Disaster Recovery & Backup:
  All system configuration is automated, versioned, and easily re-deployable. The service data is backed up, to ensure the service can be restored in case of failure. The users’ databases and their backups are stored geographically in the same data center.
• User Data Backup Policy:
  Automatic daily backups are created from users’ databases. If a backup fails to create, or if it fails the backup restoration test process, a new backup is scheduled for the database. Automatic monitoring alerts the service admins in case of multiple failures in a row, and the database owners will be notified by email if the issue can not be resolved within a reasonable time.
• Redundancy:
  The Pukki service uses cPouta and Allas as key building blocks. Pukki relies on the redundancy measures implemented by Allas and cPouta for improved availability and data integrity.
• User Account Synchronization:
  User accounts are automatically synchronized with CSC’s central user management system to maintain operational resilience. 

Measures for Testing, Evaluation, and Assessment

• Audits & Compliance:
  CSC conducts regular internal audits to evaluate the effectiveness of security measures.
• Incident Management:
  Security incidents are managed according to defined operational processes, including analysis, response, and post-incident reviews