Galooli is committed to protecting the security, availability, and confidentiality of its customers’ data.
Galooli implements a comprehensive information security program that is based on the ISO 27001 standard. This program includes various security measures of the cloud environment, including access control, data encryption, network security, and data backup and recovery.
Galooli holds ISO 9001 and ISO 27001 certifications. You can access the certificates in our knowledge base at: Quality Standards, Certifications, and Patents.
Galooli undergoes regular security audits by independent firms and our Chief Information Security Officer (CISO).
Galooli assures full compliance with GDPR requirements.
For detailed information on Galooli’s security and privacy policy, please refer to the links bellow
Should you have any questions or concerns, please contact us.
...
Unit Protection | Login | Protocol Between | System Architecture | Development | General |
|---|---|---|---|---|---|
Propriety protocol between on-site units to servers
| Password Managing
| Token based connectivity | Server systems are departmentalized, with different secured VPCs without the possibility of accessing DB | Separated environment for test and production | ISO 27001 |
Optional adding Private APN/ Restricted APN
| SSO Login
| Fully secured client-server communication - HTTPS | AWS environment
|
| GDPR |
ID to every unit
| Re Captcha V3
| End Clients installed applications are fully signed | Replicating the systems in case of an emergency |
|
|
Audit trail
| IDP Engine
| All emails from the Galooli system sent only from |
|
|
|
RBAC
| Allowed IPs
| Secure File Transfer Protocol (SFTP)
|
|
|
|
Session Timeout
| |||||
Disable Inactive Users
| |||||
Two-Factor Authentication
| |||||
Auto Logout
|
Access & Security Configuration
...
Question | Answer |
|---|---|
“What security and privacy measures has AWS implemented to protect customer data, and how does their Data Processing Agreement (DPA) relate to GDPR compliance?” | AWS has implemented a comprehensive set of security and privacy measures to protect customer data, including data encryption, access control, and audit logging. AWS also offers a Data Processing Agreement (DPA) that incorporates AWS's commitments as a data processor under the GDPR. |
"What are the storage requirements for personal data under the GDPR, and how does it relate to the protection of EU residents' personal data?" | The GDPR does not specify where data must be stored (although it does require that data controllers take appropriate measures to protect the personal data of EU residents). |
“What is the level of GDPR compliance in AWS data centers located in the US, especially in North Virginia, and where can I find up-to-date documentation on this matter?” | All AWS data centers are compliant with DGPR, including the ones in the US in general, and North Virginia in particular. See for example this up-to-date White Paper by AWS: |
“What kind of information Galooli processes? “ | The kind of information Galooli processes is detailed in Galooli's Privacy Policy, especially in the sections “Data,” and “Data Collecting.” The latter reads: "Data is collected under the legitimate business interests of the Asset Owner to enable it to monitor aspects such as, but not limited to: Asset Location, Fleet Optimization, Road and Driver Safety, Environmental Impact, Fuel Usage, Power usage." Note: Galooli does not directly process sensitive personal data. We do process non-identifiable information, such as anonymized meter identifiers and beyond-the-meter readings related to energy consumption, as well as technical factors associated with connected assets and energy sources. This data cannot be linked to any specific individual. All data transfers by Galooli are fully encrypted, utilizing HTTPS and TLS (no less than 1.2) encryption protocols. In addition, Galooli collects data on how users interact with the platform (e.g., login times, session durations, interactions with various features), including anonymized data This data is used to compile aggregate statistics and improve user experience (e.g., making popular features more visible and user-friendly). This helps us enhance the functionality and performance of our platform. The Galooli online platform also gives customer-administrators the option to manage user access and upload employees’ names, email addresses, and phone numbers, if they see fit. |
“What categories of personal data Galooli transfers?” | Galooli does not directly process sensitive personal data. However, it does collect data on how users interact with the platform to improve user experience (UX), and allows customer-administrators to manage user authorization and upload employees’ names, email addresses, and phone numbers, if they see fit. |
Information Security Incident Response and Breach
At Galooli, we prioritize data security with robust measures like encryption and intrusion detection systems. Our comprehensive Information Security Incident Response and Breach Policy outlines the steps we take to detect, prevent, manage, and effectively respond to security incidents, including both human-based and external breaches. This policy details reporting procedures, investigation protocols, preventive and corrective actions, and ongoing training for employees.
Technical and Organizational Security Measures
...