Skip to content
Check my policy

Security measures

Version 2 · in force since 3 Oct 2026

Annex II — Technical and organizational security measures

  • Encryption in transit: HTTPS/TLS for all public endpoints, HSTS in production.
  • Data minimization: consent records do not store the visitor's IP address or full user agent; the scanner does not store page content, cookie values or form values.
  • Access control: deny-by-default authorization for every action; strict tenant isolation in the database layer with automated isolation tests; roles inside each organization; administrator access limited to named staff, with a reason, a visible banner and an audit record for impersonation.
  • Authentication: single-use sign-in links that expire in 15 minutes, bcrypt password hashes with a 12-character minimum, rate limits, session list with revoke, re-authentication for sensitive changes, signed and encrypted session cookies.
  • Audit: append-only audit log (the database rejects changes and deletions).
  • Network and infrastructure: application and database on a private network; the database port is not exposed to the internet; Cloudflare network protection; bot protection on public forms; origin checks and rate limits on the public consent endpoints.
  • Application security: content security policy with per-request nonces, CSRF protection, secure headers, input validation, upload checks; automated dependency audits and static security analysis in every release.
  • Secrets: credentials kept only in the deployment environment, never in source code.
  • Resilience: immutable published editions; health checks that a new release must pass before it receives traffic.
  • Personnel: confidentiality duties; access only when needed.
  • Incident response: documented process to assess, contain and notify Personal Data Breaches (section 9).
  • Deletion: automatic deletion of consent records at the end of the retention period; deletion of tenant data after account deletion (section 10).