Technical and Organizational Measures (TOMs)

1. Encryption

1.1 Encryption at Rest

• All data stored in Firebase Firestore and Cloud Storage is encrypted at rest using AES-256 encryption, managed by Google Cloud's encryption infrastructure.
• Encryption keys are managed through Google Cloud Key Management Service (KMS) with automatic key rotation.
• Database backups, where applicable, are encrypted using the same standard.

1.2 Encryption in Transit

• All communications between client applications and EasyBoard servers are encrypted using TLS 1.3.
• All API communications with sub-processors (Anthropic, EdenAI, CloudConvert, Stripe, Resend) use TLS 1.2 or higher.
• HTTP Strict Transport Security (HSTS) is enforced on all web endpoints.
• Certificate management is automated through Netlify's managed TLS certificates.

2. Access Control

2.1 Authentication

• User authentication is managed through Firebase Authentication, supporting email/password and third-party identity providers.
• Session tokens are cryptographically signed and have defined expiration periods.
• Failed authentication attempts are monitored and rate-limited.

2.2 Authorization

• Role-based access control (RBAC) is implemented at the application level with distinct roles: Administrator, Editor, and Viewer.
• Firestore Security Rules enforce per-company data isolation, ensuring that users can only access data belonging to their own organization.
• All API endpoints verify authentication tokens and authorization permissions before processing requests.
• Administrative functions are restricted to users with explicit administrator privileges.

2.3 Administrative Access

• Access to production infrastructure is limited to authorized personnel on a strict need-to-know basis.
• Firebase project access is managed through Google Cloud IAM with principle of least privilege.
• All administrative actions are logged and auditable.

3. Data Minimization

• Audio recordings: Automatically and permanently deleted immediately upon successful completion of the transcription process. No copies are retained.
• AI processing: Anthropic's Claude API operates under a zero-retention policy -- no customer data is stored or used for model training. Prompts and outputs are not logged by the provider.
• EdenAI transcription: Audio data is processed in-memory and not retained after transcription is complete.
• Payment data: Full payment card details are never stored on EasyBoard systems. All payment processing is handled by Stripe (PCI DSS Level 1 certified).
• Logs: Application logs do not contain personal data content. Only metadata (timestamps, user IDs, action types) is logged for operational purposes.

4. Infrastructure Security

4.1 Hosting and Data Residency

4.2 Network Security

• All public endpoints are served through Netlify's CDN with built-in DDoS protection.
• Firebase services are protected by Google Cloud's network security infrastructure.
• API keys and secrets are stored as encrypted environment variables, never in source code.
• Cross-Origin Resource Sharing (CORS) policies restrict API access to authorized domains only.

5. Monitoring and Logging

• Application health is monitored through automated health checks with alerting.
• Firebase provides built-in monitoring for authentication events, database operations, and storage access.
• Netlify provides deployment logs and function execution monitoring.
• Anomalous access patterns are detected and flagged for review.
• Logs are retained for a period of 90 days for operational and security purposes.

6. Incident Response

6.1 Detection

• Automated monitoring systems detect anomalous behavior, unauthorized access attempts, and system failures.
• Firebase and Netlify provide real-time alerting for security-relevant events.

6.2 Containment

• Upon detection of a security incident, affected systems or accounts can be immediately isolated.
• Firebase Authentication allows immediate revocation of user sessions.
• API keys and credentials can be rotated without service interruption.

6.3 Notification

• The Controller is notified within 72 hours of a confirmed personal data breach, in accordance with the DPA.
• Notification includes the nature of the breach, categories of data affected, likely consequences, and remedial measures taken.

6.4 Post-Incident Review

• All security incidents are documented with root cause analysis.
• Corrective actions are implemented and tracked to prevent recurrence.
• Incident reports are made available to the Controller upon request.

7. Business Continuity

• Database redundancy: Firebase Firestore provides automatic replication across multiple availability zones within the EU region.
• Hosting redundancy: Netlify's CDN provides global redundancy with automatic failover.
• Data backup: Firestore data is continuously backed up with point-in-time recovery capability.
• Disaster recovery: Recovery procedures are documented and tested. Target Recovery Time Objective (RTO) is 4 hours; Recovery Point Objective (RPO) is 1 hour.
• Service availability: The platform targets 99.9% uptime, leveraging the high availability of underlying cloud infrastructure providers.

8. Employee and Organizational Measures

• Access principle: All personnel access to production systems and personal data is granted on a strict need-to-know basis.
• Confidentiality: All personnel with access to personal data are bound by contractual confidentiality obligations.
• Training: Personnel involved in data processing receive regular training on data protection requirements and security best practices.
• Separation of duties: Development, testing, and production environments are strictly separated. No personal data from production is used in development or testing.
• Secure development: Code changes undergo peer review before deployment. Dependencies are regularly audited for known vulnerabilities.
• Offboarding: Access rights are revoked immediately upon termination of employment or change of role.

9. Review and Updates

These technical and organizational measures are reviewed at least annually and updated as necessary to reflect changes in technology, threats, or regulatory requirements. The Controller will be notified of any material changes to these measures.