Data processing
How client data is handled during a project. This explains the practices listed in the Standards table.
1. Principle
Client data belongs to the client. Within a project, access is granted only to the extent and for the time needed to do the work. At handover, all accounts and credentials are transferred to the client.
2. Access control
Access to systems is role-based: each team member reaches only the resources their role requires. Two-factor authentication is required on all accounts (Microsoft Entra ID). Temporary access is revoked when the project ends.
3. Backup and recovery
Project data is backed up in encrypted form (Azure Backup). The restore procedure is tested periodically — what is checked is that a backup can be restored, not merely that it exists.
4. Code and releases
Every change is kept with version history. Nothing goes to production without code review and passing automated tests (GitHub Actions). Secrets are not stored in code.
5. Monitoring and incidents
Systems and APIs are monitored (Zabbix, Grafana). Critical incidents raise an alert; the first response is given within the time stated in the support agreement. The cause and the actions taken are reported to the client in writing.
6. Third-party services
Cloud and service providers used in a project are agreed with the client in advance. For sensitive data, a local or closed environment is offered.
7. Certification
The company does not currently hold ISO/IEC 27001 or any other certification. Certification is planned; this page and the Standards table will be updated as results are obtained.
8. Questions and requests
For questions about data processing or an audit request, write to the email address in the Contact section.
This document was drafted internally and is not legal advice. It will be reviewed by counsel before the company begins processing data at scale.