First things first. Why?
Some of our customers require complete anonymity, both in terms of the name of the company and the type of compounds they wish to analyse.
At invitrolize we take this premise very seriously and, if the client requires it, we can use end-to-end encrypted communications from the very beginning to avoid any leakage of information.
Below we explain how we do this and how to request it:
How we do it
Using Microsoft or Google products for privacy-sensitive purposes may not be ideal due to certain factors. Both companies have extensive data collection practices and rely on user data to personalize experiences and deliver targeted advertising.
This data collection raises concerns about privacy, as it involves the potential access, processing, and monetization of user information. While these companies have implemented various security measures, the overarching business models often involve utilizing personal information for advertising and other purposes.
If privacy is a significant concern, alternatives that prioritize privacy, such as open-source or privacy-focused software solutions, may be worth exploring. These alternatives typically offer more control over data and prioritize user privacy through measures like end-to-end encryption and minimized data collection.
For this reason, at invitrolize, when a customer asks us to enable an encryption or privacy protocol, we initiate a list of actions (detailed below) as well as the use of alternative tools to those commonly used.
1. Company name
Simple but effective. At invitrolize we place a high value on maintaining the confidentiality and privacy of our customers' information. We understand the importance of safeguarding your sensitive data, including your company name. To further enhance this level of protection, we have implemented a practice of using acronyms instead of the actual company names internally within our organization.
By employing this approach, we ensure that your company's identity remains strictly confidential among our employees. This practice minimizes the risk of inadvertent disclosure and maintains a secure and trusted environment for all our customers.
2. Non-Disclosure Agreement (NDA)
An NDA, or Non-Disclosure Agreement, is a legal contract between two or more parties that establishes confidentiality obligations regarding certain information they wish to share with each other. The purpose of an NDA is to protect sensitive or proprietary information from being disclosed or used by unauthorized individuals or entities.
When parties enter into an NDA, they agree to keep the specified information confidential and not disclose it to third parties without proper authorization. The types of information covered by an NDA can vary widely and may include trade secrets, business plans, customer lists, financial data, inventions, or any other confidential or proprietary information.
An NDA typically outlines the scope of the confidential information, the duration of the confidentiality obligations, and any exceptions or limitations to the confidentiality requirements. It may also specify the consequences or remedies for a breach of the agreement, such as monetary damages or injunctive relief.
We have ready-made NDA templates if you don't have one. However, we are happy to accept your NDA if you wish to use your own.
3. Instant messaging
Some of our customers prefert to have a closer relationship with us by using messaging applications such as WhatsApp or Microsoft Teams. Due to privacy concerns, and in case sensitive data is transferred between the parties, we prefer to use Signal. It's free and meets all security standards for end-to-end message encryption.
Signal is known for its strong emphasis on privacy and security. It utilizes end-to-end encryption, which means that the content of your messages can only be accessed by the sender and the intended recipient. No one else, including Signal itself, can decrypt or access the message contents.
When you send a message on Signal, it gets encrypted on your device using a unique encryption key that only you and your recipient possess. The encrypted message is then transmitted to the recipient's device, where it is decrypted using their encryption key. This ensures that even if the communication is intercepted, the encrypted data remains unreadable.
Signal also employs additional security measures, such as forward secrecy. This means that even if an attacker manages to obtain your encryption key in the future, they cannot decrypt past messages because each message has its own unique key.
Signal's security practices have been subject to rigorous scrutiny and audits by independent security experts. This transparency helps to identify vulnerabilities and ensures that the app's encryption protocols are robust. Signal has a track record of actively addressing any identified issues promptly.
In summary, Signal is widely regarded as one of the most secure messaging apps available, and its commitment to privacy has earned it a strong reputation in the security community. You can find more info and download the app for free here: https://signal.org/.
4. Email and file sharing
Email and cloud storage services are the center of most comunications. When using tools such as Google or Microsoft you are not using encrypted end-to-end-encryption. They use standard TLS (Transport Layer Security). Instead, we can also use ProtonMail, a secure email and file sharing provider located in Switzerland using encrypted communications.
ProtonMail is designed to provide secure and private email communication. It employs end-to-end encryption, which means that the content of your emails is encrypted on your device before it leaves your computer or mobile device and can only be decrypted by the intended recipient.
When you send an email from ProtonMail, the message is encrypted using the recipient's public key, which ensures that only the recipient with the corresponding private key can decrypt and read the message. Likewise, when someone sends you an email, it is encrypted with your public key, and only you possess the private key necessary to decrypt and access the message.
ProtonMail also offers other security features to protect your data. These include zero-access encryption, which means that even ProtonMail's administrators cannot access your email content. The encryption keys necessary to decrypt your emails are only held on your device, ensuring that ProtonMail cannot access your messages even if compelled by legal or other means.
In addition, ProtonMail servers are located in Switzerland, which has strict privacy laws and a strong legal framework to protect user data. This jurisdiction adds an extra layer of security and privacy. Switzerland is more than precise clockwork, holey cheese, and neutrality. It has tight data protection laws too. ProtonMail is based in Switzerland, which makes it bound to:
- The Swiss constitution's Article 13 (general guidance on privacy rights)
- The Swiss Data Privacy Act (unique protection for Swiss citizens and for data handled by Swiss companies)
- The European Union's GDPR laws (even though it's not a member state)
You can find more info and open a free account here: https://proton.me/mail.
5. Video calls
For this case, instead of using Google Meet or Microsoft Teams, we use Jitsi, a free and open-source video conferencing platform that offers secure and private video calls.
Jitsi offers end-to-end encryption (e2ee) as long as you are using Jitsi Meet on one of the follwoing browsers: any browser using Chromium 83 and above, including Microsoft Edge, Google Chrome, Brave and Opera.
You just need to select the “End-to-end Encryption” option in the menu and then make sure that all participants use the same password in the Key field.
Jitsi meetings operate in 2 ways: peer-to-peer (P2P) or via the Jitsi Videobridge (JVB). This is transparent to the user. P2P mode is only used for 1-to-1 meetings. In this case, audio and video are encrypted using DTLS-SRTP all the way from the sender to the receiver, even if they traverse network components like TURN servers.
In the case of multiparty meetings all audio and video traffic is still encrypted on the network (again, using DTLS-SRTP). This outer layer of DTLS-SRTP encryption is removed while packets are traversing Jitsi Videobridge; however they are never stored to any persistent storage and only live in memory while being routed to other participants in the meeting.
More info about Jitsi here: https://jitsi.org/ and the link to start using it: https://meet.jit.si/
How to request it
It's easy, all you have to do is ask for it. You can either use our contact form (see button below) or send us an email if you already know the email address of a person at invitrolize. We will guide you step by step through everything you need to know or to setup the different applications.
