NavVis security and compliance

Customer files

Scanned data, either from NavVis VLX or a 3rd party laser scanner device like a TLS, and subsequent files derived from these, for example artifacts produced by customer-triggered NavVis IVION Processing tasks applied to the original scan data.

Hosting options

NavVis IVION data is always stored on the Amazon AWS server location that the customer selects when creating their instance. For example: If you opt for the US region, your data will be stored on the AWS servers in the US.

The three regions are as follows:

• Europe – Germany (AWS region eu-central-1)
• North America – the United States (AWS region us-west-2)
• Asia/Pacific – Japan (AWS region ap-northeast-1)

All hosting locations are highly scalable, to support variable load from our customers, ensuring customers receive a stable and performant service globally. In addition, we use automated monitoring and alerting throughout to ensure our engineering teams are able to proactively support our customers where necessary.

Instance metadata is separated at the database level, with each NavVis IVION instance having its own segregated database and user in the database server within their chosen hosting region.

Customer files are stored in managed filestores hosted by AWS, with strict separation between different customers' data.

User management and permissions setting

For more information about managing users and groups in NavVis IVION see:

• NavVis IVION Documentation: Managing Users
• NavVis IVION Documentation: Managing User Groups

NavVis IVION undergoes four annual rounds of penetration testing by external companies. These experts look for vulnerabilities in our software and infrastructure, and attempt to find vulnerabilities we may have missed during our usual QA processes.

Issues discovered by penetration testing are reviewed, addressing any high and medium priority issues found. Low priority issues may be discussed and not addressed, with the testing company’s agreement. Full details of any resolved security issues in released versions of NavVis software is communicated via our change log.

Our Business Continuity Management (BCM) strategy is encapsulated by three processes: preparation, response, and recovery. Each phase plays an integral role in managing disruptions efficiently, enabling the organization to swiftly resume normal operations.

• Preparation involves pinpointing essential business functions, evaluating risks, and formulating plans to address those risks
• Response includes the immediate measures taken to manage and mitigate the effects of a disruption
• Recovery aims at strategies to quickly restore business activities to their standard operational status

To support our BCM processes, we implement extensive monitoring for critical metrics within our infrastructure, with alert systems to immediately notify our team of issues. This rapid notification allows for quick response measures, reducing potential service impact.

Encryption at rest

All data at rest is encrypted using AES 256, the industry standard for data encryption. This applies to all data in NavVis IVION and NavVis IVION Processing, regardless of sensitivity, providing a uniform layer of security across all our cloud products.

NavVis uses AWS Key Management Service (KMS) for management of the encryption keys for data at rest. This ensures our keys are kept secure, updated automatically and often, and all access and usage is audited.

Different keys are used across each of our environments (developlment, staging, production, etc.) to ensure isolation and security. For our NavVis IVION Enterprise separate keys are generated for each deployment, providing an additional layer of security by segregating encryption keys on a per-deployment basis.