Data Security
Measures

Pseudonymization and Encryption

Where pseudonymization is used, Data Processor implements appropriate measures to separate identifying information from the pseudonymized data and to protect the additional information required to attribute the pseudonymized data to an identified or identifiable individual against unauthorized access, disclosure, alteration, or loss.

Physical Security

Data Processor implements appropriate physical security measures for its offices and for computers, laptops, mobile devices, and other equipment used by its personnel to process personal data. These measures are designed to prevent unauthorized physical access, loss, theft, damage, or other physical compromise.

Where personal data is hosted or processed using infrastructure provided by a Sub-processor, including Hetzner, Amazon Web Services (AWS), OVH, and Bunny.net, the relevant physical security measures are implemented by the applicable infrastructure provider and are subject to appropriate contractual and due-diligence controls.

Data Processor manages its Sub-processors in accordance with applicable data protection and information security requirements and maintains appropriate contractual obligations relating to the protection of personal data and security.

Access Control to Data Processing Systems

Data Processor implements appropriate measures to prevent unauthorized persons from gaining access to systems used to process personal data, including production systems, databases, application servers, cloud infrastructure, and other relevant systems.

Access to personal data and processing systems is granted on a need-to-know and least-privilege basis and is limited to what is necessary for the individual's role and responsibilities.

Access rights are reviewed periodically and are revoked or adjusted without undue delay when no longer required, including upon termination or a change of role.

Privileged and Administrative Access

Access to production systems, databases, cloud infrastructure, security configurations, and other privileged functions is restricted to specifically authorized personnel whose responsibilities require such access.

Privileged access is granted on a least-privilege basis and is limited to the minimum scope necessary to perform the relevant administrative or operational function.

Multi-factor authentication (MFA) is supported for privileged and administrative accounts where enabled.

Administrative and privileged activities are subject to appropriate authorization, logging, and monitoring controls. System administrator access rights are individually assigned and are not shared between users.

Access Control to Personal Data

Persons authorized to access personal data may only access such data to the extent necessary for their assigned responsibilities and in accordance with their respective access rights.

Access to personal data is granted on a need-to-know and least-privilege basis and is limited to what is necessary for the individual's role and responsibilities.

Encryption and Cryptographic Protection

Data Processor implements appropriate measures to protect personal data and related authentication information through encryption and other cryptographic controls.

Availability and Business Continuity

Data Processor implements appropriate technical and organizational measures to protect personal data against accidental destruction, loss, or unavailability and to support the timely restoration of availability and access following a physical or technical incident.

Security Incident Management

Data Processor maintains procedures for detecting, assessing, responding to, containing, investigating, remediating, and recovering from security incidents affecting the processing of personal data.

Data Processor periodically reviews and, where appropriate, tests its incident response procedures to support effective response and recovery in the event of a security incident.

Vulnerability and Patch Management

Data Processor maintains processes for identifying, assessing, prioritizing, and addressing security vulnerabilities in systems used to process personal data.

Secure Software Development and Change Management

Data Processor maintains appropriate software development and change management procedures designed to reduce the risk of introducing security vulnerabilities or adversely affecting the confidentiality, integrity, or availability of personal data.

Development and testing activities are conducted in a manner designed to prevent unauthorized access to or disclosure of production personal data.

Transmission Security

Data Processor implements appropriate technical and organizational measures to protect personal data during transmission against unauthorized access, disclosure, alteration, or loss.

Personal data is protected during transmission using appropriate encryption and security mechanisms, as described in the Encryption and Cryptographic Protection section.

Appropriate controls are implemented to detect transmission errors, failures, or unauthorized modification of data during transmission.

Security-relevant transmission and access events are logged and monitored where appropriate.

Data Segregation

Data Processor implements appropriate measures to ensure that personal data processed for different Controllers, functions, or processing purposes is appropriately segregated and protected against unauthorized access or use.

Access to personal data is restricted through appropriate technical and organizational access controls, including differentiated access permissions based on the applicable customer, function, processing purpose, and user role.

Personnel Confidentiality and Security Awareness

Persons authorized to process personal data are bound by confidentiality obligations and receive appropriate information and training regarding information security, data protection, and their responsibilities in handling personal data.

Access to personal data is limited to persons whose responsibilities require such access and is granted in accordance with the access control measures described in this document.

Data Retention and Secure Deletion

Personal data is retained only for as long as necessary for the applicable processing purposes and in accordance with applicable retention requirements.

Where personal data is no longer required, it is securely deleted or anonymized using appropriate procedures, subject to applicable legal retention requirements and backup-cycle limitations.

Monitoring and Logging

Data Processor maintains appropriate logs of security-relevant authentication, access, administrative, and other relevant events.

Such logs are protected against unauthorized access, alteration, or deletion and are retained for a period appropriate to the security, operational, legal, and incident-response requirements applicable to the processing.

Security-relevant events are monitored where appropriate to support the detection, investigation, and response to unauthorized access, security incidents, and other security-related events.

Testing and Evaluation of Security Measures

Data Processor regularly tests, assesses, and evaluates the effectiveness of its technical and organizational security measures, taking into account the nature, scope, context, and purposes of processing and the risks associated with the processing.

Where appropriate, the results of such testing, assessment, and evaluation are used to identify and address weaknesses and to improve the effectiveness of the security measures.