Security and certifications: a cloud you can verify.
Rosters handle staff data and support sensitive organizational decisions. That is why ALISEO ES is delivered only as SaaS, on enterprise data centers in the European Union, with data segregated for each organization and public, verifiable certifications — not generic claims.
ALISEO ES is a SaaS service on enterprise data centers in the European Union: multi-tenant architecture with data segregated per organization (dedicated schema), per-organization backup and disaster recovery, HTTPS encryption, SSO, role-based access control (RBAC) and audit log. Windex is certified ISO 9001:2015 and ISO/IEC 27001:2022 (with the 27017 and 27018 cloud controls integrated) and adopts an organizational model under Italian Legislative Decree 231/01; ALISEO ES falls within the qualified service ALISEO HCM listed in the ACN cloud marketplace (SA-4199).
Last updated: 5 July 2026
SaaS only, European Union only
ALISEO ES is offered exclusively as SaaS: no servers to buy, no software to install, updates — including regulatory ones — included in the subscription fee. The service is hosted on enterprise data centers in the European Union and every connection is protected by HTTPS/SSL encryption.
All you need to work is a browser (Chrome, Firefox, Edge, Safari) and, for staff members, the SmartEmployee app on their smartphone or the myALISEO web app.
Data segregated per organization, for real
Many SaaS products claim “data separation”; ALISEO ES implements it at the architecture level:
- Multi-tenant with a dedicated schema per organization (schema-per-tenant): each healthcare organization’s data lives in its own space, not in shared tables.
- Per-organization backup and disaster recovery: backups and restores are independent — restoring one organization does not touch the others.
- Data uniqueness and historicization: every piece of information has a single source (single source of truth) and every change can be reconstructed over time — the basis of the archival evidence that makes rosters demonstrable in any audit or inspection setting.
Controlled access, tracked actions
SSO (single sign-on)
Based on KeyCloak: one corporate login, integrable with the organization’s identity system.
RBAC (role-based access control)
Each of the roles — staff member, planner, manager, Management — sees and does only what its role allows.
Audit log
Every change to the roster board and every approval is recorded — who, what, when. It is the same traceability that supports Management’s compliance approval.
Certifications and qualifications (verifiable, with links)
| Certification / qualification | What it attests |
|---|---|
| ISO 9001:2015 | Quality management system for Windex processes — cert. IT330402, Bureau Veritas / ACCREDIA |
| ISO/IEC 27001:2022 | Information security management system — cert. IT350871, Bureau Veritas / ACCREDIA |
| ISO/IEC 27017:2015 | Controls integrated in the 27001:2022 certification, specific to cloud services |
| ISO/IEC 27018:2019 | Controls integrated in the 27001:2022 certification for the protection of personal data in the cloud |
| ACN qualification — SA-4199 | ALISEO ES falls within the qualified service ALISEO HCM, qualified by the Italian National Cybersecurity Agency (ACN): acn.gov.it/portale/w/sa-4199 |
| Organizational model — Italian Legislative Decree 231/01 | Accountability and control framework for the organization |
For public-sector organizations the ACN qualification is not a detail: it is the condition that allows them to procure the cloud service in compliance with Italian regulations on cloud for the public sector — the SA-4199 record (ALISEO HCM, of which ALISEO ES is part) is publicly available on the ACN marketplace.
Personal data protection
Processing takes place entirely on infrastructure in the European Union, with data segregated per organization, encryption in transit, RBAC access and audit logs. The organization remains the data controller. The ISO/IEC 27018 controls, integrated in the ISO/IEC 27001:2022 certification, specifically cover the protection of personal data in the cloud.
‹Wording on Windex’s role under GDPR art. 28 pending confirmation from the contractual documentation — open item pre-go-live.›
Design principles (for CIOs and IT departments)
- Compliance by design: national collective agreements (CCNL) and Italian Legislative Decree 66/2003 (working time) are inside the engine, not in a separate module → Regulatory compliance.
- API-first: what you see on the roster board can be queried via REST APIs with JWT authentication → Interoperability & integrations.
- Data uniqueness and historicization as architectural principles.
- PostgreSQL database; web application accessible from all major browsers, with no client to install.
Frequently asked questions
Where is ALISEO ES data hosted?
On enterprise data centers in the European Union, with HTTPS encryption. Each organization’s data is segregated in a dedicated schema, with independent backup and disaster recovery for each organization.
Which certifications does Windex hold?
ISO 9001:2015 for quality and ISO/IEC 27001:2022 for information security, with the ISO/IEC 27017 and 27018 cloud controls integrated; Windex also adopts an organizational model under Italian Legislative Decree 231/01.
What does the ACN qualification mean?
ALISEO ES falls within the qualified service ALISEO HCM listed in the ACN cloud marketplace (SA-4199), qualified by the Italian National Cybersecurity Agency (ACN) and publicly available: public-sector organizations can thus procure it in compliance with Italian regulations on cloud services for the public sector.
How is access controlled?
Through single sign-on based on KeyCloak and role-based access control (RBAC): staff members, planners, managers and Management see and do only what their role allows. Every relevant action is recorded in the audit log.
Is ALISEO ES GDPR compliant?
Processing takes place on infrastructure in the European Union with data segregated per organization, encryption in transit, role-based access and audit logs; the ISO/IEC 27018 controls, integrated in the ISO/IEC 27001:2022 certification, cover the protection of personal data in the cloud.
Do I need to install anything to use ALISEO ES?
No: you work from the browser (Chrome, Firefox, Edge, Safari). Staff members also have the myALISEO web app and the SmartEmployee app for iOS and Android.
Does your CIO want to verify the architecture and certifications?
Pick the date and time of your demo, or write to us directly.
Book a demo