Platform security

How privacy.ro works today to protect data. The obligations towards client companies are in the processing agreement.

Connection and pages

Pages are served over HTTPS only, and the browser is told not to use HTTP for privacy.ro again (HSTS).
Public pages set no cookies and load nothing from other domains: no fonts, scripts or analytics from other providers. This is checked automatically for every version.
A strict content security policy (CSP) allows only privacy.ro's own resources, and pages cannot be framed by other sites.

Every account has a password of at least 12 characters and two-step sign-in (a TOTP code), which is mandatory, with 10 recovery codes.
Passwords are kept only as a bcrypt hash, never in clear.
After 5 wrong attempts the account is locked for a while: 15 minutes, then longer with each wrong attempt, up to 24 hours.
A session ends after 12 hours, or after an hour without activity. Company accounts and the staff panel have separate sessions and cookies.

What companies write (the record of processing, data subject requests, agreements, breaches, the data protection officer's records) is kept encrypted with AES-256-GCM, under keys of each company's own.
The companies' keys are themselves encrypted with a master key that is not in the database.
An encrypted value copied to another row or another company can no longer be opened.
When a company is deleted, its keys are destroyed.

Every read of a company's data goes through a filter for that company; an automatic check rejects code that would bypass it.
The tests open every page and form of one company with another company's session and expect “not found”.
privacy.ro's staff see a company's data only while the company grants them access, and every view appears in the company's log.

Important actions (sign-ins, changes, approvals, deletions) are written to a log in which each row holds the fingerprint of the one before: a row changed, deleted or added later shows.
The log records which fields changed, not their values.
The server's operational logs contain no visitors' IP addresses, passwords or keys.

The scanner opens sites in an isolated browser, in a process separate from the rest of the platform, with no access to the companies' data.
The browser's connections go through a filter that refuses the server's internal addresses and private networks.
Answers given in the document generator are not kept: the document is made in memory and sent.