This text awaits legal review; it is a draft until approved.
The data controller's title and contact details will be added soon.
Technical and Organisational Measures
Version 0.9 · Effective: 24 October 2026
This document summarises the technical and organisational measures we apply to protect personal data. There is no independent audit or certification (ISO 27001, SOC 2); an internal pre-assessment penetration test was done and an independent test is planned.
Access and separation
- Every company's data is marked with its company id in the database and row-level security is enforced.
- Permissions are role-based; every screen is drawn after a server-side permission check.
- Support access requires the company admin's time-limited approval, covers only a configuration summary and is written to the audit trail.
Authentication
- PINs are stored one-way and peppered; repeated wrong attempts trigger a temporary lock.
- Two-step verification (TOTP) is available for email sign-in.
- Idle sessions end automatically.
Integrity and encryption
- Connections are encrypted with HTTPS; HSTS and a per-request nonce content security policy are applied.
- Secrets and sensitive settings are stored encrypted.
- Critical approvals are kept in a linked evidence chain; later changes are detected.
- Health data is kept in a separate vault accessible only to the authorised health role.
Backup and continuity
- Backups are encrypted and their integrity list is signed.
- Restore drills are run at regular intervals.
Logging and monitoring
- Important actions are written to the audit trail.
- Personal data and secrets are masked in application logs.
- Request and body limits and rate limiting are applied; uploaded files can be scanned.
Organisational measures
- Access to personal data is limited to job need.
- Retention and deletion periods are rule-based in the product.
- In a suspected breach the affected company and, where required, the Board are informed.
This document contains no sample or fictional personal data.