We are committed to keeping your data safe and secure
Payroll and HRM data deserve careful protection. As an employer, you need to understand how Celery manages information security and who is responsible.
Celery operates an information security management system (ISMS) built on ISO/IEC 27001:2022. A dedicated Security Officer is accountable for information security. Below, we explain our security measures and how to report a security issue.
Security leadership
Celery has a dedicated Security Officer who is accountable for information security and reports to management. The role develops, implements and maintains the information security management system (ISMS). Responsibilities also include overseeing risk management and monitoring adherence to security policies.
When security incidents occur, the Security Officer investigates them and leads the response, including communication with stakeholders and regulators. The role also coordinates penetration tests and vulnerability management, and provides security awareness training.
For security matters, data protection inquiries and data breaches, the Security Officer is your primary contact. You can find the current role holder on our About us page and get in touch at [email protected].
Information security management
Celery operates an ISMS built on ISO/IEC 27001:2022. Certification is in progress; no audit date is set.
Management (CEO, CTO and CCO) has ultimate responsibility for information security. The CEO is the Data Protection Officer.
Our ISMS follows Plan-Do-Check-Act: regular risk assessments, controls, effectiveness monitoring, internal audits, management reviews and corrective actions. We document our risk assessment and treatment methodology and track results and corrective actions.
Management approves our Information Security Policy. Supporting policies cover access, incidents, continuity, privacy, development, suppliers and other security controls. We review policies at least annually.
All employees complete monthly security awareness modules and phishing simulations. New employees receive onboarding training; developers attend secure coding training. Employees sign confidentiality obligations; contractors and suppliers sign NDAs before access.
Application Security
Security training
Developers attend secure coding training. All employees receive ongoing security awareness training.
Development best practices
Our secure development guidelines cover input validation, output encoding, authentication, authorization with least privilege, session management, error handling and logging. They also cover encryption of sensitive data, dependency management, code review with automated analysis, and security testing throughout development.
Separate environments
Development, staging and production environments are strictly separated. We do not use production or customer data in development or testing. Only authorized personnel can access production.
Application Security
Vulnerability scanning
We run dynamic application vulnerability scans weekly with Acunetix by Invicti.
Penetration testing
Qualified, independent security experts perform penetration tests every 6 months. We track findings through to remediation.
Fixing vulnerabilities
Our targets for patching or mitigating vulnerabilities are 24–48 hours for high priority, 1–2 weeks for medium priority and within a month for low priority.
Endpoint protection
All Celery devices have endpoint protection, with managed detection and response from an external security partner. We also use centralized logging and automated error tracking.
Physical Security
Facilities
Celery runs on its own bare-metal servers in a Tier 3 datacenter in Curaçao. The operator provides redundant power with UPS and generators, cooling, and fire detection and suppression. Our Security Officer verifies the operator's Tier 3 status and certifications annually.
Monitoring
The datacenter operator provides 24/7 environmental monitoring. Surveillance and alarm systems are in place, and servers have redundant power and network cabling.
On-site Security
Physical access to server environments is restricted to authorized personnel. Visitors are escorted at all times.
Location
Our servers are in Curaçao. A hot-standby environment in Germany holds the latest application and data. Encrypted off-site backups are stored in Germany and Ireland, in the European Union.
Encryption
Data in motion
All connections use TLS encryption with AES-256-GCM.
Data at rest
Customer data is encrypted at rest with AES-256, using GPG with 4096-bit RSA keys. Celery laptops use full-disk encryption. We keep passwords and keys in a password manager.
Backups
Backups are encrypted both at rest and in transit. Off-site copies are stored in geographically separated locations in Germany and Ireland.
Availability & Continuity
Uptime and status page
Our uptime target is 99.9%. We use database replication and failover procedures. Check our public status page for updates. If customer-facing services are affected, we issue a public statement within a couple of hours and inform customers via the status page and email.
Backups
We back up critical data, including databases, payroll data and documents, every hour. Automated restore tests run daily.
Business continuity and disaster recovery
We test our Business Continuity and Disaster Recovery plan at least annually, with tabletop, system recovery and alternate-site tests. Employees receive annual continuity and recovery training.
Reporting a security issue
Report security issues to [email protected]. Include the date and time, what you observed, affected systems or URLs, steps to reproduce, and your contact details.
We will acknowledge your report. We triage every report, may contact you for details and inform you of the outcome where appropriate.
Responsible disclosure
- Do not access, modify or delete data that is not yours.
- Do not run denial-of-service or social-engineering attacks.
- Do not publish details before Celery has resolved the issue.
- Stop and report as soon as you can demonstrate the issue.
We will not take legal action against good-faith researchers who follow these rules. Celery has no paid bug bounty program.
Additional Product Security Features
Access privileges and roles
Celery uses role-based access with least privilege. Permission levels within your Celery account include account administrator, account user, company user and employee.
Multi-factor authentication and SSO
Multi-factor authentication is available for users. Celery also offers single sign-on through SSO/SAML.
Incident management
We register, triage, classify, resolve and review security incidents. Personal-data breaches trigger notification to regulators where required.
Data residency
Data stays within Curaçao, the Kingdom of the Netherlands and the European Union. Transfers elsewhere only take place if adequate protection has been verified.
Safe and easy to use!
We believe in the balance between safety and ease of use. Judge for yourself by creating a test account.
