Opencity Labs operates under an integrated management system certified by accredited third-party bodies: ISO 9001 (service quality), ISO 20000-1 (IT service management), ISO 27001 (information security), ISO 27017 (security for cloud services), ISO 27018 (protection of personal data in the cloud). ISO 22301 certification for business continuity is currently in progress.
OpenCity Italia services are ACN-qualified at level QC1 and available in the ACN Marketplace (entry SA-3874). This means the solution has passed the suitability assessment for use by Italian public administrations.
Where your data is stored
Data from public administrations and citizens is hosted on Amazon Web Services infrastructure in European datacenters, in compliance with GDPR and current personal data protection regulations. Data never leaves the European geographic perimeter.
System protection and access
Technical staff access to production systems is via encrypted protocols and individual key authentication, through a virtual private network. Access to systems using simple passwords is never permitted. Network rules (firewall and environment isolation) restrict access to authorised personnel only.
Backup and recovery
Backups are performed every day, with multi-level redundancy. When needed, data can be restored within defined timeframes documented in the disaster recovery plan, which is periodically tested with planned exercises.
Continuous monitoring
Services are monitored 24 hours a day, 7 days a week, with automatic notifications in case of anomalies. The target service availability is 99% or higher. All traffic is protected by up-to-date SSL/TLS certificates, fully managed by Opencity Labs. At any time, any platform outages are published on the status page and our investigation and resolution process is tracked transparently.
Code security
Source code, software dependencies and application components are subject to periodic automated scans for known vulnerabilities. Security updates are applied as part of the normal release process, without service interruptions.
High-security extension for organisations within the NIS2 scope
Opencity Labs has been using Cloudflare for over ten years to protect its own infrastructure. This expertise is available as an extension of the SaaS service for organisations subject to the obligations of the NIS2 Directive (Legislative Decree 138/2024). By delegating domain management on Cloudflare to OCL, an organisation can activate advanced protection features — WAF, DDoS mitigation, traffic control, DNS protection, Zero Trust access — configured and operated daily by the Opencity Labs technical team. This is a solution designed for organisations that need to document adequate technical measures under NIS2 or that manage high-traffic, high-criticality digital services.
Following a vision of technological evolution and continuous improvement, the OpenCity Italia team analyses feedback from the community, partners, clients and users and channels it through a public roadmap and a set of activities visible on GitLab. It also supports authorities using the platform in conducting tests and publishing their technology improvement plans for the site and services (this activity also includes the tests and interventions required by the technical specifications for PNRR funds for the development of websites and digital services based on Lighthouse performance scoring).