Data Processing & Security

Tenant isolation

Every record belongs to one institution (and branch). Every request is checked on the server against the signed-in user's institution, branch and role permissions.

Access control

Role-based permissions per module. Records outside a user's scope are treated as not found.

Repeated failed sign-ins lock the account temporarily; sign-in endpoints are rate limited.

Session refresh tokens are stored only as hashes, rotated on use and revoked on sign-out or password reset.

Password reset links are single-use and expire quickly.

Files

Uploaded documents are checked for type and size and are only downloadable through short-lived signed links issued after a permission check.

Audit trail

Important actions are recorded in an audit log that institution owners can review and export.

Sub-processors and hosting

Hosting region, infrastructure provider and sub-processors will be listed here before go-live (to be confirmed).

Data return and deletion

On termination, institutions can request an export of their data. Deletion timelines are set out in the institution's agreement.

Breach notification

We will notify affected institutions without undue delay and support them in meeting their obligations to the Data Protection Board and affected persons.