Security and NIS2

Directive (EU) 2022/2555 (“NIS2”) was transposed in Italy by Legislative Decree no. 138 of 4 September 2024. Among others, it covers medium-sized and large providers of cloud computing services and managed ICT services, which must register on the platform of Italy’s National Cybersecurity Agency (ACN), adopt the risk management measures of Article 24 and notify significant incidents to CSIRT Italia, the national computer security incident response team.

Every year, during the registration window set by the ACN, Outline Digital checks whether, given its size and activity, it falls among the “essential” or “important” entities, and if so it registers and complies with the obligations of the decree. Regardless of any obligation, we organise Plannify’s security according to the ten areas of measures in Article 24 of the decree, described below, because many of our customers are (or work for) NIS2 entities and need to be able to assess their suppliers.

Responsibility for Plannify’s security lies with the management of Outline Digital, which approves these measures, reviews them at least once a year and after every significant incident, and is accountable for them. The security point of contact is info@outlinedigital.it (subject “Security”), telephone +39 327 609 2869.

They follow the areas of Article 24(2) of Legislative Decree 138/2024 (Article 21 of the Directive).

• The Mac app is signed with a Developer ID and verified by Apple (notarised). Updates are downloaded from plannify.it and we check their SHA-256 hash before opening them.
• The first connection of a computer requires confirmation on the computer itself; the connection link works only once and expires after 30 minutes.
• The agents work only in the project folder; secret files (.env, keys) are always excluded; dangerous commands (such as stopping system processes) are forbidden to the agents.
• Sensitive actions (publishing, sending messages, paying, releasing to production) wait for your approval, according to the rules you choose.
• The preview of the project the team is building opens on an address separate from Plannify’s: the project’s code can’t see your session and can’t act on your account.
• Every job can be traced: the HQ records who did what, when and with what result.

• The accounts of the people who use your business software (team members and, if you allow it, customers) are separate from Plannify accounts: whoever signs in to the business software doesn’t get into your Plannify account.
• The server checks each role’s permissions on every request, not the page: anyone who mustn’t see a piece of data doesn’t receive it.
• The data of each business software is separate from that of all the others.
• No AI-written code runs on Plannify’s servers: the business software’s automations are rules that Plannify executes.
• Each business software runs closed off and separate: its pages can’t see the data, sign-ins or pages of other business software or of Plannify, even though the address starts the same way (plannify.it/gestionali/ followed by the name).
• You sign in with the business software’s email and password, of which we keep only the hash. After too many failed attempts, sign-in is paused for a few minutes.
• Changes requested in the chat belong to the owner only and go online immediately: each one is a version, and you can go back to the previous one without losing data. Removing a section, a field or a role requires confirmation. Versions written by the team on your computer go online only with your go-ahead.
• The business software’s data is included in the nightly backups, kept for 14 days.

1. Detection: checks on the state of the service, server logs, reports from customers and researchers.
2. Containment: we isolate the problem (for example by revoking tokens or sessions, or stopping a component) and preserve the evidence.
3. Communication: if your data is involved, we notify you within 48 hours of becoming aware of it, as provided for in the data processing agreement. If the incident is significant for a service you use as a NIS2 entity, we send you an initial notice within 24 hours, so that you can meet your deadlines towards CSIRT Italia (early warning within 24 hours, notification within 72 hours, final report within one month).
4. Authorities: where we are the controller, we notify the Italian Data Protection Authority (Garante) within 72 hours where the law requires it; if we fall among NIS2 entities, we notify CSIRT Italia within the deadlines of Article 25 of the decree.
5. Recovery and lessons: we restore the service, from backups if necessary, and update the measures and the risk register; on request, we give you a written report.

The database is copied every night and before every release; the copies are kept for 14 days and then delete themselves (so the data you delete really does disappear). The service’s code is version-controlled and the whole service can be rebuilt from scratch with a single command. The code of your projects is on your computer, in the git repository the team uses: keep a copy of your own too (for example on a remote git service).

You choose the AI providers and the services you connect: they are your suppliers, and in your supply chain assessment they should be considered together with the safeguards they offer. For maximum control you can have the team think with a model on your computer: the text never leaves your computer.

NIS2 requires you to assess the security of your ICT suppliers (Article 24(2)(d) of the Italian decree). To help you:

• this page, the data processing agreement and the list of sub-processors are public and kept up to date;
• we answer customers’ security questionnaires and, on request, provide a signed statement on the measures adopted;
• we notify you within 24 hours of a significant incident affecting the service you use;
• you can export all your data at any time (“Download your data”) and choose where the AI models run, so you don’t depend on us.

If you find a security issue in Plannify, write to info@outlinedigital.it with the subject “Security”, describing how to reproduce it. We reply within 3 working days and keep you updated until it’s fixed. We ask you not to access other people’s data, not to degrade the service and to give us time to fix the issue before making it public: in return, we will take no action against anyone who reports in good faith. The same contact is in /.well-known/security.txt.

For transparency, here is what isn’t in place yet and what we’re working on:

• sign-in with passkeys, in addition to the two-step verification already available;
• a second copy of the backups in another data centre;
• the Windows app signed with a code-signing certificate.