N-central Multi-Instance Security and Compliance FAQs

Q: What data does Dreamtsoft use and where does Dreamtsoft get this data from?

Dreamtsoft platform is a non-traditional SAAS (more appropriately, PlatformAsAService) that allows partners to develop applications, or bundles, that achieve a myriad of functions.

As of Wednesday 17th January 2024, N-Able has no plans to provide this functionality to end users and as such, data ingestion is only limited to what bundles N-able will be providing as default. This is provisionally limited to the Service Management (or Multi-Instance) bundle.

Q: What data will the Multi-Instance bundle be using?

The Multi-Instance bundle is designed to be a holistic, centralized view for partner’s N-central servers and thus relies primarily on data generated from these systems.

Examples of this include:

  • CI Device Information

  • Company (Site) Location

  • Logged in User Information

The platform will also allow configuration of Azure IDP Tenants and MSP SSO Login, reference information allowing these users to log in to the platform, but no secure information from these systems is stored outside of their place of origin.

Q: How is my data protected in transit?

The infrastructure of a Dreamtsoft deployment uses SSL termination at the point of ingress (nginx webserver) so that application code cannot be circumvented by bad actors. Offloading the responsibility to the nginx ‘pod’ ensures that N-able is using the same methodology for all products within the forge environment. The Dreamtsoft platform has been migrated to the N-able infrastructure and is being used as proof of fact that N-able is working towards secure and modern solutions to security.

Q: Can you explain how the platform employs data sovereignty policies?

Dreamtsoft has a unique concept called ‘spaces’. Spaces should be considered a data tenancy agreement whereby data is only shared to other users of the system that belong to a space at or are parented to a given space. Spaces that exist horizontally to one another (in other words, Partner 1 and Partner 2) do not share any data.

In the current iteration of the Dreamtsoft platform and intended space layout, data exists on the same, secured Aurora RDS instance managed by N-able, but if a partner so wishes, they are able to take advantage of another key feature of the platform – Data mappers. A data mapper can be used by a partner to store data in any way they wish. For example, if Partner B wishes for their own business data to be stored in their database, they can leverage a mapper to do this.

Q: Who owns the data?

All data is owned by the partner, Dreamtsoft, along with the Multi-Instance bundle is currently only processing data that is ingested by configured N-central data sources or Authentication providers.

Q: If I leave N-able as a partner, can I get my data exported.

Yes, all data is exportable from within the platform itself.

Q: My customers have PII and medical data which cannot be hosted by third parties. How do you handle that scenario?

As the Multi-Instance bundle is only using data that comes from N-central, no PII or medical data can be ingested into the platform, therefore no sensitive information is included in transit.

Q: Who has access to the data?

As Dreamtsoft is a platform, it enables RBAC to ensure data is only visible by certain groups and users that belong to it. Users of the platform that belong to one partner are not able to view others. N-able UDP and Platform Administrators will have access to the platform to perform maintenance tasks if required, all access to the platform is audited and can be exported upon request.

Q: What industry compliances is N-able certified on?

N-able holds ISO27001 certification and we expect to complete SOC2 Type 1 certification in Q1 2024, and SOC2 Type 2 certification at the end of 2024.