Security and data protection at ePost

Encryption and key management

• Data is encrypted during transmission and storage.
  
• Transport encryption using TLS 1.2+; internal communication via mTLS 
  
• Storage with AES-256
  
• Client-specific logical separation
  
• Stand-alone vault infrastructure for key management
  
• Unencrypted content can only be accessed by authorised processes. The cloud provider does not have access to plain text data.
  

The master key is protected by additional safeguards and can only be reconstructed within a defined emergency procedure.

Security monitoring and emergency processes

The systems are continuously monitored.

Defined analysis and escalation processes are in place for security incidents. 
These are carried out in collaboration with the Swiss Post security units.

The infrastructure is designed with redundancy. Recovery procedures are documented and regularly reviewed. 

Access control 

Access to systems and data is based on clearly regulated principles:

• Role-based access control 
  
• Multi-factor authentication 
  
• Principle of least privilege 
  
• Logging of security-related accesses 
  

The above does not apply to electronic letters and related metadata. These can only be decrypted and read by the tenant.

Certification and testing 

ePost is certified to:

• ISO/IEC 27001
  
• ISAE 3000 (archiving in conformity with AccO)
  

The following are additionally conducted: 

• Regular external penetration tests
  
• External security reviews
  
• Cloud Lawful Access Risk Assessments (monitored by PostCom and the Swiss Federal Data Protection and Information Commissioner)
  

ScanningService

The scanning service processes physical mail in Switzerland.

• Opened mechanically
  
• Digitised in a secure environment
  
• Encrypted prior to digital delivery
  
• Physical originals stored for a limited period
  
• Destroyed in accordance with defined security standards
  

The service providers used are ISO-certified, meet high data protection and security standards, and are regularly reviewed.