Security
How Viper Systems protects your business data in the managed IT service and in our software, whether a system runs on your own server or on our hosting.
Managed IT: your server
Each company has its own Windows server, hosted on Contabo and managed by Viper Systems. The server accepts connections only through a VPN (Tailscale), so it is not open to the internet. People reach it with Remote Desktop over the VPN, from any location. Viper Systems keeps the server updated.
Managed IT: backups
- Backups are encrypted and stored offsite on Backblaze B2, up to 5 TB.
- Contabo also takes automatic server backups and snapshots.
- A second encrypted copy is kept by Viper Systems on separate storage.
- Daily backups keep 30 days of restore points. Monthly restore points are kept for 12 months.
- A single file or the whole server can be restored to any saved date. Viper Systems performs the restore.
Managed IT: remote support
Viper Systems connects to office computers with Splashtop Remote Support. For a live session, the person at the computer gives an access code. Computers can also be set up for access when no one is at them.
Managed IT: providers
- Contabo: server hosting
- Tailscale: VPN
- Splashtop: remote support
- Backblaze B2: offsite backup storage
Insurance and scope
Viper Systems carries technology errors and omissions liability insurance. Systems that store medical records (HIPAA) or payment card data (PCI) are not part of the managed IT service.
Where your data lives
On your server. Southwind Books and custom systems can be installed on your own server. The program only accepts connections from inside your network, so people reach it through your VPN.
On our hosting. Websites, booking systems and hosted programs run on Cloudflare's network, with encrypted connections and each client's data kept separate.
Who can see what
Every person has their own login, and every login has its own permissions.
- A company login only sees that company.
- Bookkeepers only see the companies assigned to them.
- The owner sees everything and controls who has access.
- Permissions are checked on every screen and every action, not only at sign-in.
Logins and passwords
- Passwords are stored as one-way hashes. Nobody can read them, including us.
- Optional two-step sign-in with a code from an authenticator app.
- Accounts lock after five failed attempts.
- Sessions end automatically after a period of inactivity.
- The owner can switch off any login immediately.
Encryption
All traffic between a computer and the program is encrypted. Backups are encrypted before they leave your server, using a key that only you hold.
Backups
- A full backup every night, kept on your server for 30 days.
- An encrypted copy stored off-site, so a fire, theft or ransomware attack doesn't take your records with it.
- A backup is taken automatically before every update.
- Restores are tested every quarter.
Audit trail
Every sign-in, entry, change and export is recorded with the person's name and the time. Entries in the books are never deleted. A correction is recorded as a new entry that reverses the old one, so the history is always complete.
Updates
Security fixes are released as soon as they're ready. Updates are installed when you choose, never in the middle of your month-end, and every update can be rolled back.
Our access
On a system installed on your server, we have no access unless you give it to us. When you need support, you decide how we connect and for how long. On hosted systems, we only access your data to provide support you ask for. Either way, our actions are recorded in the audit trail.
Report a problem
If you think you've found a security problem in any of our software, email support@vipersystemsllc.com. We respond within one business day.