Trust takes architecture, not declarations.
We show where we keep the data, how we limit access, how we test the system, and what happens during an incident or at the end of the service.
- Responsibility model You are the data controller, we are the processor. The scope will be set out in the data processing agreement (DPA) we are preparing with our law firm.
- Architecture and data location Report content and backups are kept in the European Economic Area. Client environments are separated.
- Encryption TLS in transit, encryption of data and backups, separate keys for the identity vault.
System safeguards
See how we protect data, restrict access and handle security incidents.
Responsibility
You are the data controller, we are the processor. The scope will be set out in the data processing agreement (DPA) we are preparing with our law firm.
Our responsibility: application and infrastructure security, tenant separation, keys, backups, audit logs and subprocessors, and control over our own staff. The client’s responsibility: the reporting procedure, authorisations, case routing, decisions and exports.
Get the DPA and security documentsHigh-level architecture
The platform runs in four separated zones: the reporting portal, the organisation panel, the marketing site and the data layer. The core database and the Identity Vault are two separate databases with separate access roles.
Job queues and the evidence store are separated from the application layer. The application container image contains no browser and no third-party rendering engine.
Data location
The primary data location is OVH in Warsaw. Backups are stored in GRA (Gravelines) and Paris 3-AZ in France. Both backup locations are in the European Economic Area (EEA).
Encryption
TLS protects every connection in transit. Data and backups are encrypted at rest at the application level (envelope encryption), with a separate key for each tenant and a separate key for the Identity Vault.
Keys are rotated and versioned, and the end of a contract can end with the cryptographic destruction of the tenant key (crypto-shredding). The Enterprise plan allows you to bring your own key (BYOK).
Identity and roles
Sign-in supports passkeys/WebAuthn, TOTP and hardware keys. Company sign-in with Google Workspace and Microsoft Entra ID is being prepared.
Access to the Identity Vault and to exports requires an additional confirmation (step-up). Nobody has access by default (deny-by-default), high-risk actions require two people (dual control), and technical access by operator staff to a specific case is granted for a limited time and recorded in full in the audit log (JIT).
A portal with no trackers
The reporting portal loads no analytics scripts, no advertising pixels, no session recording, no heatmaps, and no third-party fonts or CDN assets.
This is the line between the marketing site (which may use analytics tools after consent) and the portal, where such a tracker would be incompatible with the purpose of the service.
Backup and continuity
Backups are encrypted and kept in the EEA. We will publish the restore test schedule and its results once the service is live.
Recovery priority after an outage: the reporting portal and the case mailbox come first.
Secure development
Every code change goes through automated scanning (static code analysis, dependencies, secrets, infrastructure configuration and container images) plus tenant isolation and negative authorisation tests.
Higher-risk features have their own definition of done and go through a security review before release.
Testing and certifications
We will run a penetration test of the platform before the service launch. Afterwards we will publish an executive summary, and the full report will be shared after an NDA is signed.
Below is the status of every step of the certification roadmap — with no standard’s logo shown before the certification actually exists.
Incidents
Incident handling is an organisational procedure on our side, not a module in the system. We notify the client of a confirmed personal data breach without undue delay and no later than 24 hours after we establish it — at night and at weekends too.
An incident notice describes the scope of the action and never reveals the existence of a specific case.
Subprocessors
A published list with the role, location and transfer basis. We announce changes at least 30 days in advance for subprocessors that touch case content.
Marketing tools are not subprocessors of the reporting portal.
Subprocessor list| Provider | Service | Region | Scope | Access to content |
|---|---|---|---|---|
| MTRZK SOLUTIONS P.S.A. (Polska) | Hosting, administracja, utrzymanie i kopie | Polska: OVH Warszawa; kopie: GRA i Paris 3-AZ (Francja) | Infrastructure | Limited |
| OVH sp. z o.o. | Infrastruktura, dyski/obiekty i kopie | Polska (Warszawa); kopie: GRA i Paris 3-AZ (Francja) | Infrastructure | Limited |
| Vercom S.A. (EmailLabs) | Transakcyjne neutralne alerty e-mail | EOG — deklaracja dostawcy | Reporting portal | No |
| Vercom S.A. (EmailLabs) | Transakcyjne neutralne alerty e-mail | EOG — deklaracja dostawcy | Organisation panel | No |
| Vercom S.A. (EmailLabs) | Wysyłka materiału, potwierdzenia adresu i newslettera po zgodzie | EOG — deklaracja dostawcy | Website and marketing | No |
Retention and end of service
Every plan has a defined retention policy. Data under a legal hold is not deleted automatically until the hold is lifted.
When the contract ends a paying customer receives an export of the documentation, and the tenant key can be destroyed cryptographically (crypto-shredding), which makes any remaining encrypted data unreadable. The detailed rules, including after an unpaid trial, will be set out in the terms of service.
Responsible vulnerability disclosure
Report a vulnerability to security@strefasygnalisty.pl. The safe harbour scope does not cover client production data, client portals, denial-of-service attacks, or social engineering against our staff or our clients.
Acknowledgement of a report: up to two business days. Initial assessment: up to five business days. Critical vulnerabilities are patched outside the release cycle. We do not run a public bug bounty today — a private researcher programme will start once we reach operational readiness.
Get the security pack
Frequently asked questions about security
Where are the data and the backups physically kept?
In the European Economic Area. The content of reports is never transferred outside the EEA, and we will name the infrastructure provider on the subprocessor list before the service launch.
Can your staff read the content of a report?
Not in normal operation. Technical access requires your consent, is time-limited and is recorded in full in the audit log.
How does content encryption differ from Identity Vault encryption?
They use separate keys, a separate database and separate access roles — breaking one layer gives no access to the other.
What happens to the data when the contract ends?
A paying customer receives an export of the documentation, and the tenant key can be destroyed cryptographically (crypto-shredding). The detailed rules will be set out in the terms of service.
Can a client bring its own key (BYOK)?
Yes, on the Enterprise plan — you can import your own key into the vault.
How do you make sure one client never sees another client’s data?
Several independent isolation layers plus automated cross-tenant tests on every release; a bug of that kind has the highest priority here.
Do you share the penetration test report?
We will run the test before the service launch. Afterwards we will publish an executive summary and share the full report after an NDA is signed.
How quickly will you tell us about a breach?
Without undue delay and no later than 24 hours after we establish the breach, without disclosing the details of any specific case.
Does the reporting portal use cookies or third-party scripts?
No. That is the difference between the marketing site (which may use analytics tools after consent) and the reporting portal, which loads none of them.
Do you send data to AI tools?
No. Recording transcription, when enabled, runs locally in a worker with no network access.
Who is the controller of reporting persons’ data?
Your organisation. We are the processor — except on the marketing site, where we are the controller.
Can I object to a new subprocessor?
Yes. The objection procedure and deadline will be set out in the data processing agreement (DPA) we are preparing with our law firm.