Cloud-based Software Cybersecurity Details

Secure Development Lifecycle

Schneider Electric is continuously monitoring the changing security landscape of cryptography and cybersecurity to ensure that we offer the best available protections to our customers and their sensitive data.

Our development practices follow a Secure Development Lifecycle which ensures a high level of code quality and usage of up-to-date libraries in order to ensure an optimal level of Cybersecurity.

EcoStruxure Facility Expert applications as well as all Schneider Electric cloud systems are regularly audited by an internal process which includes Penetration tests.

Certified Data Centers

Our cloud services are physically deployed across multiple Microsoft Azure data centers. Microsoft data centers are world-class facilities with more certifications than any other cloud provider.

The data centers used by EcoStruxure Facility Expert are located in multiple countries. Certifications and compliance achievements include ISO/IEC 22301, 27017, 27018, and ISO/IEC 27001 in addition to SOC 1, SOC 2, and SOC 3. To learn more about Microsoft Azure data centers, visit: https://azure.microsoft.com/en-us/support/trust-center/.

Data Security At Rest

Schneider Electric follows best practices to create a highly-secured solution and to limit the risk of data being compromised in any meaningful manner while protecting the privacy, control, and autonomy of each customer data independently from any other.

Our solution includes:

• Customer information (PIM: password, email, profile) is stored and encrypted in a corporate Identity Management System (IMS).

• System to system credentials and tokens are stored and encrypted in EcoStruxure Facility Expert databases located in the Microsoft Azure cloud.

• Customer functional data including time-series is segregated logically in the EcoStruxure Facility Expert SQL database located in Microsoft Azure cloud.

• Customer data is encrypted at rest in EcoStruxure Facility Expert databases.

Data Security In Motion

Schneider Electric with EcoStruxure Facility Expert implement best practices as:

• All communications to and from EcoStruxure Facility Expert with internal Schneider Electric systems or external third-party systems, are encrypted using HTTPS (minimum level required is TLS 1.2).

• Certificate involved in these encrypted sessions is leveraging SHA 256 secure hash algorithm.

• This also applies to communications between our on-premises data loggers (Com'X, SE8000, Wireless Panel Server, EcoStruxure Panel Server) and Schneider Electric Cloud platform. Schneider Electric is continuously monitoring the changing security landscape of cryptography and cybersecurity to ensure that we offer the best available protections to our customers and their sensitive data.

Data Privacy

Schneider Electric focuses on securing data flows coming from connected products and solutions (whether they connect to non Schneider Electric hosts or platforms managed by Schneider Electric), and on aligning to the latest data integrity and privacy regulatory requirements such as the European General Data Protection Regulation (GDPR).

• Data policy is compliant with local regulations.

• Customer Data Use and Protection policy is to be electronically signed by the Responsible of the site (for example, Building owner, Tenant). No data will be exported without this agreement.

Data remains customer ownership.