<aside> 🗣 Classification: PUBLIC This page is shared externally to Alan prospects, customers, and business partners. 🇫🇷 translation: Sécurité et protection des données chez Alan (FR)

⚖️ For DORA Compliance specifics, head up to DORA Compliance (EN)

</aside>

We understand that many companies require their Information Security departments to audit and review all third party systems and software. In order to provide a streamlined set of answers, this is our latest statement, which is regularly updated by our security team.

Member refers to individuals receiving insurance coverage or using health services provided by Alan, whether through a direct contract with Alan or through a group contract.

Company admin refers to individuals designated by corporate customers of Alan to manage the customer’s contract with Alan, including in particular the management of employee enrollment.

End-user refers collectively to members and company admins Alan refers to the Company, its subsidiaries, affiliates, employees, and contractors.

When such transfers are necessary, we restrict them to only the minimum data needed, and ensure that legal instruments (such as Adequacy decisions, Standard Contract Clauses, or Binding Corporate Rules) are in place to guarantee an adequate protection of data and data subjects’ rights by the receiving party, in line with the requirements of GDPR article 46. Where appropriate, we also implement additional security measures in line with EU case law requirements. | | Where are Alan employees located who have access to data? | Alan offices are exclusively located in the European Union.

Alan also allows employees to work remotely, subject to compliance with our Work From Anywhere policy. Remote access to Alan workspace is strictly regulated to ensure that data access remotely is adequately secured. This includes the use of a VPN to connect to Alan applications and workstation security controls, as well as compliance with all internal rules set forth in our Acceptable Use Policy.

In addition, Alan employees are subject to robust contractual commitments to privacy, confidentiality, and security of information accessed throughout their employment, which carry on effects after employment termination. | | Data transfers | | | How is data encrypted in transit? | All data transfers use encrypted transport (TLS 1.2 or better, SSH/SFTP). We enforce the use of secure connection (HTTPS, HSTS) for all Alan web service. | | How are your data networks protected? | Our public web servers are protected by Cloudflare front-end servers acting as WAFs and load balancers, as well as in-app attack detection and mitigation (Datadog ASM). Our infrastructure is deployed on virtual private networks that are not directly accessible from the outside. All access to internal application and resources from outside Alan headquarters must go through encrypted and individually authenticated VPN connections. | | Data deletion | | | How long do you keep the data? | The main data retention periods for insurance are as follows: • 2 years for health insurance data (care procedures) • 10 years for provident insurance data • 5 years for administrative data (including employee affiliation). | | Do you have a legal obligation to keep them for a specific period? | The durations above are based on the statute of limitations for insurance disputes and Alan's obligations (AML-FT) | | Do you have a procedure for deleting/purging data at the end of their retention period? | The data lifecycle is automated. | | Cookies | | | Does your solution use cookies? | Yes, we use the following categories: • cookies necessary for user authentication device (1st party) • cookies necessary for the customer support online chat service (1st party used for Intercom popup) • audience measurement cookies (1st party) • targeted advertising effectiveness measurement cookies (exclusively on the public parts of the Alan website, never on authenticated access pages) | | Do you have a Cookie Management Policy? | Our cookie management policy is incorporated into our privacy policy. | | Do you offer users the option to refuse all cookies ? | Yes, a banner to manage cookies is displayed from the first login screen for this purpose. | | Tenancy | | | Is Alan’s application multi-tenants? | Yes, and we implement logical separation of data. | | Business continuity | | | Do you have a Business Continuity Plan? | Yes, we have established a Security and Business Continuity Policy, and defined a Business Continuity Plan including controls to mitigate all significant risks we have identified that might impact the continuity of our operations. | | How often do you perform backups? | We back up our production databases and systems every night. | | How do you protect from accidental data loss? | Our production and backup data is replicated across geographically distinct data centers (AWS availability zones in the Frankfurt region). In addition, a further copy of backups is stored in the Paris AWS region. | | How do you protect from accidental infrastructure loss? | We favor a preventive approach by leveraging cloud service providers with a redundant and resilient infrastructure and a proven track record for robustness. We do not store any data locally. We follow an Infrastructure as Code approach, meaning that we keep our infrastructure configuration in a machine readable repository | | How do you protect from unavailability of your premises? | We are fully prepared for 100% home office operation without any disruption or impact on activity. Every employee has a personal, secure VPN access and mobile workstation. | | How do you protect from unavailability of key team members? | We implement a radically transparent, written-first culture. All key knowledge and data necessary to decision making and daily operations is digital and available to all internal stakeholders who need it in their work. | | Identity and access management | | | End users | | | How do you authenticate end users? | We use login (email address) and password authentication. We enforce minimal length (16 characters) and complexity of passwords (zxcvbn score, 2 different character categories). We enforce exponential backoff on authentication endpoints to defend against attempts at brute-force attacks on user passwords. | | How do you store end user passwords? | We follow industry standard practices to protect end user passwords: they are stored using a bcrypt hash with one-use salt and a cost of 12 (i.e. 4096 rounds). | | Is two-factor authentication available for end users? | Yes, end users can enable multi-factor authentication on their Alan account. The second factor is a notification in the Alan mobile app, with a short-lived code sent by email as a fallback. | | How is access to applications and data authorized? | Members are authorized to access data in their own account. Company admins are authorized to access the data necessary to perform the administrative duties related to their assigned role, as assigned by the primary company’s admin. | | Can end users use an external identity provider to sign into Alan applications (SSO, social login)? | Not currently. | | Alan staff | | | How do you authenticate Alan staff? | We use Single Sign On accounts for Alan production systems as well as third-party service providers. We configure our SSO provider to enforce minimal length (15 characters) and complexity of passwords. | | How do you store Alan staff passwords | These passwords are stored only by our SSO identity provider (Google). We never see or store them in our systems. We provide a corporate password manager license to each employee for secure handling of their passwords. | | Is two-factor authentication available for Alan staff? | Two-factor authentication is mandatory on Alan SSO accounts and all third-party services that support it. | | How is access to applications and data authorized? | Access permissions are granted based on role requirements on the basis of the need-to-know and least-privilege principles, and updated as necessary to reflect changes in professional assignments. A systematic reviews of accounts and permissions is performed bi-yearly. | | Traceability and accountability | | | Audit trails | | | Is there an audit trail of data changes? | Yes, all data changes are historized, including the identification of the user that performed them. | | Is there an audit trail of data access? | Data access through our business applications generates audit trail records. | | Logging | | | Is user account activity logged? | Yes, application login and logout events are logged, as well as unsuccessful login attempts, and credentials changes. | | Is database activity logged? | Yes, database queries are logged. | | Are logs protected against tampering? | Yes, our log management systems (Cloudwatch and Datadog) do not allow modification of log records. | | Application management | | | Application architecture | | | Do you implement a tiered architecture to protect essential business components? | Yes: • we use Cloudflare as our front-end tier to guard against denial of service and malformed requests • our back-office is deployed in an AWS virtual private cloud network, with private IP addressing and no direct access from the Internet • our production database also is in a separate AWS VPC network | | Application changes and updates | | | Do you have a documented change management process? | Yes | | How are Alan’s applications developed? | All applications and back-office business tools are developed and maintained internally. | | How often do you typically deploy new application releases? | Several times per day | | What checks does source code undergo prior to deployment? | • Automated scanning for common errors and security vulnerabilities • Automated test suite (unit tests - regression tests) • Approval from peer review | | Do you have development and acceptance testing environments? | Yes, each developer has an isolated testing environment, and we have a shared acceptance testing environment for merged changes. Test environments use either fake data, or anonymized production data.

Databases containing anonymized production data are kept in a secure infrastructure with the same level of protection as the actual production database. | | Vulnerability and security events | | | Incident response | | | Have you formalized an incident response plan? | Yes, the following processes related to incidents are formally documented: • preparedness: roles and responsibilities are clearly defined, first responders are trained and identified • during incidents: a well defined procedure is followed to hedge the impact of the incident, resume normal operations, and communicate to all stakeholders • aftermath: a post-mortem analysis is conducted systematically for every incident. | | Do you notify third parties of security incidents? | We notify personal data breaches as required by law. We also notify security incidents to stakeholders (customers, business partners) if necessary, depending on the specific impact of each incident. | | Do you keep a registry of incidents and data breaches? | Yes, we keep a record of every production incident, security incident, or personal data breach. These records capture: • incident timeline • extent of incident (impacted systems, records, and persons) • immediate action undertaken to mitigate the incident • short and long term corrective action identified as necessary to prevent recurrence • communication to relevant stakeholders, including notification to regulatory authorities • root cause analysis and key learnings | | How do you handle personal data breaches? | Any incident that impacts personal data is immediately notified to the DPO team. The extent of the violation is assessed (nature of compromised data, number of records and of persons impacted, nature of breach) and regulatory notifications to the CNIL (as lead supervisory authority) and/or to the data subjects are made as necessary. Specific records are made of the assessment and of any notifications made, in addition to general incident tracking records. | | Vulnerabilities | | | Do you run a bug bounty programme? | Not currently. However, we gladly accept reports from external security researchers, and we reward them at our discretion when they bring issues to our attentions that we estimate are putting us at significant risk and were not previously known to us. | | Are your applications scanned for vulnerabilities by a qualified third party? | Yes, we commission yearly penetration tests, and we can share a summary of the latest campaign. | | How are critical security patches applied to your systems and applications? | We redeploy our applications multiple times a day from the latest operating environment base images of our platform provider, so upstream security measures are always promptly deployed. Security-related changes to internal code are always prioritized through our issue management and continuous integration systems. Vulnerabilities assessed by Alan shall be patched or remediated in the following timeframes: • Urgent: 2 business days • High: 1 week • Medium: 6 weeks • Low: 6 months | | Attack detection and mitigation | | | Is your application infrastructure protected against denial of service? | Yes: we leverage Cloudflare’s front-end service for load balancing and denial-of-service mitigation. We also implement rate limits on some critical application endpoints. | | Is your application infrastructure protected by a WAF? | Yes (Cloudflare WAF). In addition, we leverage Datadog’s Application Security Monitoring agent to filter all requests prior to processing by our application layer. This in-application component flags and blocks attack patterns such as injection attempts, and also tracks abnormal and malicious behaviour, and blocks attackers’ IP address automatically. | | Human resources and user environment | | | Hiring and employee onboarding | | | Do you perform background checks on employees? | Yes, we perform criminal record checks where permitted by law. We also require identity and right to work documentation, as well as references from previous employers. | | Do you have an information security awareness programme? | Yes: during their structured onboarding process, all new employees receive trainings on security and privacy. We follow up with regular security updates, reminders, and interactive on-line refresher courses. We run continuous simulation-based awareness operations on phishing. We share the main findings of security audits with the team at large. | | Are your employees bound to security and privacy obligations? | Yes, our employees and contractors are contractually bound by confidentiality clauses and by our policy on acceptable use of information systems. | | Work environment | | | Are end-user workstations managed? | Yes, all workstations issued to employees are managed through MDM | | Is the operating environment on end-user workstations kept up to date with vendor security patches? | Yes, system updates are enforced through MDM | | Are workstations encrypted? | Yes, full-disk encryption is enforced through MDM. | | Is access to user sessions protected? | Yes, user accounts must use a robust password or biometric authentication, and sessions must be locked out anytime the workstation is unattended. This is enforced through MDM. | | Supply chain management | | | Relationship with suppliers | | | Do you include security requirements in your contracts with suppliers? | Yes, we review the security posture and practices of our suppliers to ensure that they are adequate with respect to the criticality of the service provided, and the sensitivity of the data we share with them. We draft security clauses in contracts based on this assessment. | | Software dependencies | | | Do you address vulnerabilities in off-the-shelf software components used in your applications? | Yes, we have automated alerts and remediation for vulnerabilities identified in our open source software dependencies. | | Privacy and GDPR | | | Processing role | | | Is Alan a controller or processor? | Alan acts as an independent data controller for most activities, including the provision of its insurance services. Alan determines on its own the mean and purposes of processing activities to carry out. These are covered by our Privacy policy, available at https://alan.com/privacy, and referenced in the "Data Protection" clause of our general terms and conditions.

However, on the specific and narrow scope of employee affiliation, Alan acts as a processor, processing personal data on behalf of the customer. In this context, the customer passes data relating to the employees to be invited to Alan, and Alan provides the customer with required information to establish payroll payroll. Such limited processing activities are covered by the Data Processing Agreement (DPA) annexed to our general terms of conditions under the title "Data Processing Agreement”. | | Alan Privacy Principles | |