budget123 runs on a web server

budget123 is web based and runs on Microsofts Internet Information Server 7.5. A certificate (issued by GeoTrust Inc.) is installed on this server, and using SSL to encrypts the communication between the web server and the users web browser with 128 bit.

The certificate is issued to the domain https://*.mitbudget123.dk.

Your data is stored in a separate database

Data for each company is stored in a separate database. This database can be accessed only by one specific database-user matching the user created in budget123. Thus every budget123 user has a separate database-user.

The database server is a PostgreSQL version 9.1 (http://www.postgresql.org/)

Security trumphs everything

The source code for budget123 is written in C# and is based on Microsoft .NET 4.0. In addition to this, we use a third-party component from dotnetcharting and ASP.NET AJAX Control Toolkit.

For communication between the database and the application we use a third-party component from IBATIS net.

Standard forms authentication in .NET is used when a user logs in to budget123. The user must enter company id, user name and password to access budget123.

As mentioned above the application runs on an IIS 7.5 on a Windows Server 2008, hosted by Athena IT-Group (read Athena IT-Groups description of their it-controlls). The database and IIS is on the same physical maschine. The hosting agreement with Athena IT-Group guarantees an uptime of 99.9 % in the time interval 06.00 - 23.00 every day all year. The agreement includes monitoring of the following operations:

	Basic monitoring of hardware (operating system, network card, power, etc.)
	Ongoing security control of Merc IITs data and Merc Its access.
	Ongoing upgrades of system corrections (operating system, etc.)
	Ongoing monitoring of system resources.
	Retrieval and ongoing control of daily backup

Daily backup of your data

We backup databases once every 24 hours and store it for 30 days. After 30 days we store one version every week for a year. Immediately before every new version of budget123 is released the latest backup of the databases are recreated on a mirrored server, where the new features are tested before final release.

Once every 24 hours the entire production server is backed up at Athena IT-Group. This backup is stored on a different physical locality than the servers. The backup is stored for 21 days.

Transporting data from accounting system to budget123

e-conomic

budget123 retrieves data in e-conomic using e-conimics own API. This is based on web services and SOAP version 1.2. As budget123 is developed in .NET, we also use e-conomics .NET API.

Thus e-conomics API encrypts the transfers between e-conomic and budget123.

Accounting system without web service

For systems that are not able to access a web service, we use a Windows service (DataQueryService (DQS)) that is developed for the purpuse. This is the case for accounting systems such as C5, Navision (Nav), Visual Administration, etc.

Servicen DQS maintains two data connections:

• A connection to the accounting systems database, that connects to different types of databases and several accounting systems using ODBC.

• A connection to budget123s server, that controls jobs and messages to the service. This connection is encrypted using the frame work WSE3 (Web Service Enhancemants for .Net 3.0)

The process for data retrieval is:

1. A user clicks on Update accounting data in budget123 (i.e. user interaction)

2. A job regarding the integrated accounting system is added to the job list on budget123s DQS server

3. A DQS service asks the server, if there is a job to carrie out, which is confirmed

4. The service executes the job on the accounting systems database, e.g. using ODBC

5. Data is serialized and returned to budget123s server.

Every data transfer is carried out using an internet connection, that is encrypted and signed with a designated user name and password.