FAQ

Our web-based applications are easily accessible on both touch and desktop devices, requiring only an Internet connection and modern browser. In this way, staff can access and work with training data from their desks. Other than the dedicated computer used alongside the Senso hardware, no special hardware or software setup is needed. By delivering the applications through the Internet, we can continuously work on extending, improving and securing them in an economical manner, reducing both cost and maintenance effort for our customers. We believe this is crucial for enabling a large portion of our customers to securely operate the software.

The core of the personal data processed by our software is a history of each individual's training progress, comprising of exercise time and results. Beyond this, personal information (such as name, sex and date of birth) can but don't need to be stored in the system. Our software also offers aids for performing various assessments, the results of which are then stored for correlation with exercise results. All of this personal data is stored and processed exclusively to serve the customer's needs and is not passed on to third parties or used to mine information. During the operation of the client and server software, logs are collected for monitoring the health of the instances and ensuring proper functioning. Logs relate to events in the servers, software and data bases, and do not contain information about individuals. After a period of 60 days, all logs are deleted from our servers. Aggregate, non-personal information about organizations may be accessed by Dividat to support in the use of the software. Upon customer request, Dividat employee may also access individual data to analyse or resolve customer issues.

The personal data at the heart of the software is stored in Swiss datacenters operated by Nine Internet Solutions AG, where various physical measures against data theft and loss are in place. Additional server infrastructure is operated in Switzerland and Germany, but does not handle any data that is directly relatable to any person. The passwords of customers are stored in hashed and salted form. Access to our core backend servers is limited to selected Dividat employees and requires hardware tokens for authentication. The configuration of the servers is subject to version control and repeatable ("infrastructure as code"), patches are applied on an ongoing basis. Recovery backups are created nightly and removed after a period of 7 days.

Both our clients and backends require HTTPS, using TLS 1.0 to 1.2. Where TLS 1.0 is still being offered, additional MitM mitigation mechanisms are in place. Authentication endpoints are subject to rate limiting to prevent brute force attacks.

Our services' availability is continuously monitored. Both current and past availability can be viewed at status.dividat.com. The status website is operated by a third party and should still be accessible in case our services become unavailable.

Our goal is to make our services available to you at each hour of every day. We have designed our systems so that ordinary updates do not cause any downtime. On rare occasions it may be necessary to take the system offline for routine or emergency maintenance. If we believe that an operation might cause noticeable downtime, we will aim to schedule it outside of peak usage hours. In this case, we will give advance notice via email. In the case of an unexpected downtime, our hosting provider and monitoring service will alert our engineering team.

According to our monitoring service Pingdom our web services have had a yearly availability above 99.99 % since their start in 2016. This includes the backend server at api.dividat.com, as well as our user-facing websites at play.dividat.com and manager.dividat.com.

The software Dividat develops undergoes peer review and is subject to version control. Continuous integration (CI) is in place to automatically run tests each time the software is changed. We use multiple channels for publishing the software, such that new releases can be tested first internally, then with select partner organizations, and only then be made generally available.