Encryption

Phones

Data on phones can be encrypted using the phone’s own encryption software as well as third party tools for managing and securing phones.

Network

All data sent over the network is encrypted using SSL. Port 80 should not be opened on your firewall.

Server

Data is not currently encrypted on the server. This is a trade off with the risk of loss of data. If the server is deployed on a device that is not always running, for example a laptop, then the disk of the laptop should be encrypted.

Backups

All backups created by the hosted service are encrypted.

Authentication

Access to all data, with the exception of reports and media files, requires a user id and password. Media files and attachments are secured using a random sequence of characters in their URL.

Authorisation - User Roles

Users can be assigned one of 4 roles

  1. Organisational Administrator: Can create new organisations and move users and projects between organisations.
  2. Administrator: Can create and edit users and projects. However they cannot access organisations other than the one they are currently in.
  3. Analyst: Can create forms and view collected data.
  4. Enumerator: Can download forms and submit results but cannot view the results on the server.

Access Control - Compartmentalising data

Organisations

Data collection is performed within an “organisation”. The people working in that organisation cannot access the data in another organisation unless they have also been given the “organisational administrator” role.

Projects

Forms are created in Projects. Users can be assigned to multiple projects. An analyst or enumerator will not be able to see forms in projects that they have not been assigned to.

Firewall

Only port 443 needs to be open on the server all other ports should be blocked.

Installing on a Private or Virtual Private Network

Smap can be installed in your own data centre if you have concerns about using a hosted server. It can then be set up to work on your own private or virtual private network.

The hosted server can also be attached to a virtual private network if required.