Security

XM London takes the security and resilience of its hosting service extremely seriously.

Physical security/protective measures:

• XM London servers are contained in three purpose built server rooms within our building, and all access to these rooms is strictly limited to the systems administrators who have been extensively vetted
• The server rooms themselves are secured through a combination of locks, alarms and ID security and are monitored 24 hours by CCTV
• Entrance to the building is monitored 24 hours by security staff
• Physical protection of the servers room such as flood drainage flooring, non – hardware damaging anti fire prevention systems are in place

Technical security measures:

• Network access is secured by redundant Hardware Cisco firewalls
• WAN connection consists of two differently located physical network pipes of 34Mb run by separate service providers
• Automatic failover is in place for both Cisco firewalls and leased lines
• Our WAN setup/security with Intrusion Detection Systems and Intrusion Prevention Systems facilities are managed externally by CMT who globally manage the WPP data centres
• Security at server level is enforced with best practice length, complexity and expiry times of passwords
• Auto-updating, anti-virus software is configured as standard upon all installed servers, as is the use of Microsoft Baseline security tool testing, security patches and URL scan software to ensure any IIS services are protected to the greatest level possible
• High resilience levels are achieved by the redundancy of services at all levels, leased lines / ISP providers / switches / firewalls for the hardware, independently powered server rooms / battery backup UPSs, and a diesel generator with 48hrs of fuel
• XM has worked with a number of penetration testing companies (including Quinetic) who have tested our infrastructure on behalf of the Royal Family, and HSBC Security division for HSBC, as well as several other third party penetration companies.

Data backup

XM adheres to the Sarbanes – Oxley Act on data protection act by ensuring all hosted data is comprehensively backed up.

All data is initially backed up to an IBM Tivoli disk to tape system that continues to incrementally back up daily. Every 24hrs disk data is migrated to tape backup. These tape copies are stored off-site and are removed daily.

By default the backup data is retained on a daily basis for about three months; however, other retention plans allow for a monthly copy of the data to be retained for longer.