HRS Security

Software Security

The FileMaker security model is based on three key components:

1. Account Name - identifies the individual user

2. Password - proves the user is who they say they are

3. Privilege Set - defines access limits for user(s)

Account Names and Passwords control access to the file for each individual. Account Names and Passwords together are referred to in information security compliance guidelines as Identity. The Privilege Set controls what the user can see and do. The use of Privilege Sets allows you to define what is referred to in information security compliance guidelines as Role Based Security. Security settings defined within the file using FileMaker Pro are largely file specific. Accounts and privilege sets established in one file, control access to the information and schema stored in that file. Security settings configured within FileMaker Server are server specific and apply to all files hosted by the server.




HRS Documents are encrypted and only accessible using our HRS solution. Encrypted container fields are encrypted using AES-256. The Documents are self-contained within the Database so only accessible with a valid username and password.

An example of an AES-256 encrypted document is the following file path:




The result of this is:


Hardware Security

We host all our servers on UKFast.

For more information on each provider's data centre capabilities visit the links below.

UKFast - 

UKFast data centres follow the highest control on user access with 24/7 manned security.


Information on their security can be found here:

You will see that they meet the ISO 27001/2 standard.


Firewall and Administrative Access

All our servers sit behind UTM Firewalls ensuring the highest level of security. All Firewall rules are reviewed on a 3 monthly cycle to ensure that the only required rules are maintained on the devices.

Administrator access to our servers is only possible from certain IP addresses, and only granted to a set number of system administrators


Connection between Client Application and Servers

The connections between client applications and servers can be secured by SSL thus ensuring that snooping of Data by means of session hijacking or Man in the Middle attack methods are not possible.


HRS Security Controls

Below are the security controls we have implemented to ensure data security.

Server Access

Server access is limited to a set number of system administrators and this access is reviewed every 3 months to ensure that appropriate access is maintained at all times.

Passwords Strength and Security

HRS follows a system of using complex passwords that have a minimum 10 characters and adheres to the below:

  • has uppercase letters
  • has lowercase letters
  • has numbers
  • has symbols, such as ` ! " ? $ ? % ^ & * ( ) _ - + = { [ } ] : ; @ ' ~ # | \ < , > . ? /

Password History

All passwords expire every 3 months and need to be replaced. The 6 last used passwords cannot be used to ensure compliance industry standards.

Data on Servers

All data on servers are stored in a database format which is password protected.

Data transferred is encrypted using 7zip and password protected to stop it from being compromised.

Data encryption using Encryption At Rest (EAR) is currently carried out on a request basis, as this impacts on the performance of the application. As we have very stringent controls on how we protect and control access to our data, we rarely have a request to encrypt the data stored on the servers.


HRS Backup Procedures

Database Backup

The FileMaker Server application backs up all client databases on a nightly basis with a retention of 5 days data. There is also a single weekly backup of the databases with a 3 week retention. In addition to these backups we also run a nightly backup of all database to an offsite server with a 1 day retention for disaster recovery purposes.

Disaster Recovery

The server and all drives are backed up on a nightly basis with a 1 day retention. This is an offsite backup used for disaster recovery purposes.

In the event of server failure, the server will be re-imaged using the image stored on the offsite backup.

Our servers are regularly maintained every 4-6 weeks with any required updates. In addition to this, server monitoring software runs 24/7 to alert the team of any issues with performance.

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request


Article is closed for comments.
Powered by Zendesk