Security & Privacy

Biblionix sets a high bar for security and privacy of your data. And your patron data is private. We do nothing with it but save it for you. No harvesting, no marketing. Our data protection is all encompassing, including:

ALL Apollo and Artemis pages (public catalog and staff pages) are encrypted with https
All SIP2 connections are encrypted
The database is encrypted on the servers
The backup servers are encrypted

We challenge any system to do more to protect your data and patron privacy.

We will not connect your data with any 3rd party that does not use encrypted SIP2. SIP2 is typically used by e-book services, PC time/print management software and the like. Without encrypted SIP2, every log-in by a patron results in much of their personal information being sent over the Internet in clear text; adult data and child data alike. (Marshall Breeding) has cited our high protection level in several articles over the years.

As a defense, your vendor may say that they don’t do anything with such patron data. Well, that doesn’t matter; the horse is already out of the barn. The SIP2 standard requires that the ILS reply to SIP2 login requests with the patron’s personal information whether or not the requesting software uses that data. And if the connection is not encrypted, that patron data is exposed on the Internet, unprotected. Our CTO is a member of the NISO Working Group for SIP3 where he is working to get encryption included.

Here are some questions to ask your vendors about security:

To your ILS vendor, PC time/print management vendor, e-book vendors, etc.: “Do you encrypt your SIP2 connections with my library?” If the answer is no, find a new vendor fast or get them to fix it fast.

To your ILS vendor: “Does the login for our patrons use https, thus ensuring that whatever patrons do in the catalog is encrypted before going over the Internet?” If the answer is no, insist on an https/encrypted connection while you are searching for a new ILS vendor.

To your hosted ILS vendor: “Does the login for staff use https, thus ensuring that staff activity is encrypted before going over the Internet?” If the answer is no, insist on an https/encrypted connection while you are searching for a new ILS vendor.

To your ILS vendor: “Do you offer secure passwords like my bank does?” Secure passwords are hashed when stored so that no one can read them. This is not as critical as the above issues, but it can sure be embarrassing if a patron calls you on it.

For more information, refer to these articles by Alison Macrina and April Glaser with whom we have been in touch:

Securing your data is frankly not hard; your vendors just have to take it seriously. Demand it of your ILS vendor, or allow us to protect you!