Security & Compliance

Data Security Measures

Encryption

• Data at Rest: AES-256 encryption for all stored data
• Data in Transit: TLS 1.3 for all client-server communications
• Database Encryption: Transparent data encryption (TDE) enabled
• Backup Encryption: All backups encrypted with separate keys

Access Controls

• Multi-Factor Authentication (MFA): Required for all user accounts
• Role-Based Access Control (RBAC): Granular permissions by user role
• Single Sign-On (SSO): SAML 2.0 and OpenID Connect support
• Session Management: Automatic logout and secure session handling

Network Security

• Web Application Firewall (WAF): Protection against common attacks
• DDoS Protection: Built-in mitigation for distributed attacks
• IP Whitelisting: Available for enterprise customers
• VPN Support: Secure tunnel access for enterprise deployments

Infrastructure Security

Cloud Provider

We use Amazon Web Services (AWS) with data residency in EU regions:

• Primary: eu-west-1 (Ireland)
• Secondary: eu-central-1 (Frankfurt)
• ISO 27001, SOC 1/2/3, and PCI DSS certified infrastructure

Data Centers

• Physical Security: 24/7 monitoring, biometric access controls
• Environmental Controls: Redundant power, cooling, and fire suppression
• Compliance: ISO 27001, SOC 2 Type II certified facilities

Monitoring and Logging

• Security Information and Event Management (SIEM): Real-time monitoring
• Audit Logging: Comprehensive logs of all system activities
• Intrusion Detection: Automated threat detection and response
• Log Retention: Security logs retained for 7 years

Compliance Certifications

Data Processing and Storage

Data Residency

• All customer data stored within the European Union
• No cross-border transfers without adequate protections
• Customer choice of primary data location (Ireland or Germany)

Data Retention

• Assessment Data: Retained for 7 years for audit purposes
• User Account Data: Retained while account is active plus 90 days
• Security Logs: Retained for 7 years
• Backup Data: Encrypted backups retained for 1 year

Data Deletion

• Secure deletion within 90 days of account closure
• Cryptographic erasure for encrypted data
• Deletion certificates available upon request
• Compliance with "right to be forgotten" requests

Business Continuity

Backup and Recovery

• Recovery Point Objective (RPO): 15 minutes
• Recovery Time Objective (RTO): 4 hours
• Multi-Region Backups: Automated cross-region replication
• Testing: Monthly disaster recovery testing

Availability

• SLA: 99.9% uptime guarantee
• Monitoring: 24/7 system monitoring and alerting
• Incident Response: <4 hour response time for critical issues
• Maintenance Windows: Scheduled during low-usage periods with advance notice

Vulnerability Management

Security Testing

• Penetration Testing: Annual third-party penetration tests
• Vulnerability Scanning: Continuous automated scanning
• Code Security Reviews: Static and dynamic application security testing
• Dependency Management: Regular updates and vulnerability patching

Incident Response

• 24/7 Security Operations Center (SOC): Continuous monitoring
• Incident Response Plan: Documented procedures and escalation paths
• Notification: Customer notification within 24 hours of security incidents
• Forensics: Digital forensics capabilities for incident investigation

Third-Party Security

Vendor Assessment

• Security questionnaires for all vendors
• Regular security assessments
• Contractual security requirements
• Limited data access on need-to-know basis

Key Vendors

• AWS: Cloud infrastructure (SOC 1/2/3, ISO 27001)
• Stripe: Payment processing (PCI DSS Level 1)
• SendGrid: Email services (SOC 2 Type II)