Technical and organisational measures

• Hosting: Google Cloud Platform (Firebase), region europe-west1 (Belgium). All primary data is physically stored in the European Union.
• Database: Firebase Firestore (NoSQL) multi-region with synchronous European replication.
• Document storage: Firebase Cloud Storage, region europe-west1.
• Serverless compute: Firebase Cloud Functions Gen 2, region europe-west1.
• CDN and DNS: Cloudflare (with SCC and TIA for data in transit).
• Transactional email: Sendinblue/Brevo (France).

• Encryption at rest: all data at rest is encrypted with AES-256 (Google-managed encryption keys, optionally customer-managed keys for enterprise plans).
• Encryption in transit: TLS 1.3 with modern cipher suites (HTTPS mandatory, HTTP redirect, HSTS active with 12-month max-age).
• Passwords: hashed via Firebase Auth (scrypt/bcrypt-equivalent algorithms). No plaintext password is ever stored.
• Application tokens: signed JWTs, limited validity, automatic refresh, server-side revocation.
• Event reporting tokens: 32 URL-safe characters generated with the Web Crypto API (CSPRNG), ~191 bits of entropy, computationally infeasible to brute-force.

• User authentication: email/password with enforced minimum complexity, or Google OAuth.
• Lockout: after repeated failed attempts, temporary account lock and email notification.
• Password reset: via OTP link expiring in 60 minutes.
• Email verification: email address verified before the first critical action.
• Session: JWT token with configurable validity, explicit logout available from any device.
• Permissions (Studio): granular owner/editor/viewer roles with database-side Firestore Rules enforcement.
• Multi-tenancy: logical and physical separation of workspaces via Firestore Security Rules. A user cannot access data of a workspace they are not a member of.

• Automatic backups: daily Firestore snapshots with 30-day retention; weekly backups with 12-month retention.
• Disaster recovery: RPO (Recovery Point Objective) max 24h; RTO (Recovery Time Objective) max 8 working hours.
• Document versioning: version history of uploaded documents with timestamp and actor.
• Soft delete: deletions in production are first soft-deleted, then hard-deleted after 30 days (allows recovery in case of user error).
• SLA target: target monthly uptime 99% (see Terms of Service Sec. 10).
• Monitoring: continuous monitoring of availability, latency and errors; automatic alerting to the team on anomalies.

• Append-only audit trail: every relevant action (login, document change, event handling, token generation/revocation, data export) is recorded in a dedicated, non-editable activity collection.
• Log retention: 5 years from generation, unless defence needs require otherwise.
• Public token usage tracking: each use of the reporting form increments usageCount and records lastUsedAt for audit.
• System logs: Cloud Functions logs and infrastructure access retained for a minimum of 90 days.
• Tamper detection: any change to the logs is detectable via incremental hashing.

• Updates: continuous updating of software dependencies with monitoring of published CVEs (Dependabot, npm audit).
• Critical patches: applied within 72 hours of public disclosure.
• Data breach procedure: notification to the Controller within 48 hours of discovery, in compliance with Art. 33 GDPR.
• Security testing: manual code review and functional testing at every significant release.
• Penetration testing: planned annually from January 2027.
• Responsible disclosure: vulnerability reports accepted at security@dpoworkspace.eu.

• Authorised personnel: access to production data limited to Pietro Cravero (owner and DPO) and formally appointed collaborators under a specific confidentiality agreement.
• Need-to-know: access to personal data limited to what is strictly necessary for technical management and support activities.
• Training: continuous staff training on information security and personal data protection.
• Confidentiality: all collaborators are bound by a written confidentiality obligation.
• End of relationship: immediate revocation of all access upon termination of the collaboration.
• Sub-processing: sub-processors authorised with a DPA compliant with Art. 28(4) GDPR. Public list at /sub-processors.

Event reporting link

• 32-character URL-safe CSPRNG token (~191 bits entropy)
• Expiry configurable by the DPO user (90/180/365 days or none)
• Immediate revocation available
• Database-side validation (Firestore Rules): existence, non-revocation, clientId/workspaceId consistency
• Size limits on public form fields (anti-payload)
• usageCount and lastUsedAt tracking
• Client-side rate limit (5 seconds between consecutive submissions)
• No sensitive client data exposed in the publicly readable tokens collection

Event handling workflow

• Complete audit trail of every completed step (timestamp + userId)
• Structured saving of the DPO's decisions (handling field on the event)
• User permission check for every action (Firestore Rules)
• Soft-delete of events with 30-day recovery option

Payments

• No card data stored on our systems
• Stripe Checkout in a secure iframe (Stripe PCI-DSS Level 1)
• Subscription synchronisation via signed webhook
• Stripe Customer Portal for self-service payment method management

Primary data is stored exclusively in the European Economic Area (region europe-west1, Belgium). Non-EU transfers limited to:

• Cloudflare (DNS/CDN): network metadata, static assets. Covered by SCC 2021/914 + TIA.
• No sensitive personal data in transit on Cloudflare thanks to end-to-end TLS encryption.
• TIA documentation available on reasoned request.

We plan the following improvements, communicated publicly for transparency:

• Q3 2026: 2FA via TOTP for all plans
• Q4 2026: Annual external penetration test
• Q1 2027: ISO/IEC 27001 certification (audit kick-off)
• Q1 2027: SOC 2 Type I for enterprise Studio plans
• Q2 2027: BCR (Binding Corporate Rules) if applicable