Security and data protection

The security measures applied to keep organisations' data apart, to control access rights and to keep activity records.

Organisation data is kept separate

Every record is tied to the organisation it belongs to. Access rules are enforced at both the application and the database level.

Users reach the relevant data through their organisation's own address and their own rights.

Passwords are stored securely; passwords found in known data breaches are not accepted.

Accounts can be protected with an authenticator app; access is restricted after repeated failed sign-in attempts.

Each user's access is defined and managed separately for every organisation.

Contact details are viewed only by authorised people, and each access is recorded.

Identity and contact details, as well as access credentials, are not held in plain form in application logs.

Retention of and access to records are managed under the terms of the contract; the activity history can be traced.

Attachments are not made accessible until the security check is complete.

Only permitted file types are accepted; a mismatch between content and extension is detected.

Files found to be risky in the security check are not made accessible.

Credentials used in settings such as the organisation's mail server are stored encrypted.

Who carried out submission and administrative actions, and when, can be reviewed by authorised people.

Bot verification and request limits reduce automated abuse.