Payroll Data Access Specifications

Suran offers data hosting services for Payroll clients using our established hosting service.

Elements

Facilities

Cloud VMs

• Services are hosted on Linode VMs managed by Suran

• Suran manages the entire server

• Linode manages underlying hardware

• Linode provides

  • Redundant power

  • Redundant fiber

  • 24/7/365 onsite NOC

• Rotating snapshots of VMs are taken and stored with Linode 

• Servers are continuously monitored for uptime, resource usage, data integrity by Suran

• Administrative access to servers is limited to the Suran operations and development team

• Each server hosts data for multiple clients (multi-tenant) using unique database(s) per client

• Suran servers offer the same disk-level Payroll database encryption as DealerBuilt-hosted database servers

Client Backups

• A logical (pg_dump) backup is taken nightly of each database

• Backups are uploaded to Amazon AWS' S3 service

• Backups are retained for one day on the local hosting server

• Backups are retained for 14 days on S3

• Access to S3 is limited to:

  • The hosting server via API

  • Suran operations and development team

• Client data can be loaded by by development for triage within our hosting environment and is not stored on developer workstations

Ports

IP Addresses

• ferret.suran.com is reachable at 172.104.11.248

• Hosting server IP addresses vary

• Access to databases for a given client can be restricted to source IP(s) (dealer location) for additional security, if desired

Payroll Authentication and Data Access

1. Each client is given a unique hosting ID and password

2. Payroll is configured with this hosting ID and password in lieu of an IP address/port

3. Payroll authenticates with Ferret

4. A host and available databases are returned

5. Payroll authenticates to the host and connects to a database with the hosting ID and password using an encrypted connection

6. The user authenticates with their username/password stored in the Payroll database

7. The user logs in and uses the applications

LightYear Authentication and Data Access

1. DealerBuilt staff configure the LightYear databases with:

   1. Data Hosting Server IP

   2. Database name

   3. API PostgreSQL user name (specific to the client)

   4. API PostgreSQL password (specific to the client)

2. LightYear databases connect with the API credentials to the client database to perform direct data access 

Engage Authentication and Data Access

1. User enters their unique Engage URL

2. Engage sends the unique URL to Ferret

3. Ferret provides a hosting server and provision code (unique ID for that database) 

4. Engage authenticates to Suran API on the hosting server with the provision

5. Suran API uses the provision to connect to the client's database

6. Engage queries Suran API for the organization name and logo

7. Engage presents a branded login window 

8. User enters their username and password

9. Engage authenticates to Suran API on the hosting server with the username, password, and provision

10. Suran API uses the provision to connect to the client's database

11. Suran API authenticates with the username and password stored in the client's database

12. Suran API returns an authentication token

13. Engage stores the token and provision in a browser cookie

14. Subsequent requests provide the token and provision for authentication

15. Tokens are revoked after 30 minutes of inactivity