Security · Data protection
Security Measures
This document describes the technical and organisational measures that Avatia, acting as data processor, implements to ensure a level of security appropriate to the risk, in accordance with Article 32 of Regulation (EU) 2016/679 (GDPR).
1. Pseudonymisation and encryption
- Encryption in transit. All external communications take place over encrypted channels (TLS 1.2 or higher), with TLS terminated at the load balancer.
- Encryption at rest. Databases and storage volumes are encrypted at rest. Object storage uses server-side encryption with per-tenant keys.
- Key management. Cryptographic keys are handled through a managed key-management service with restricted access.
- Minimisation and pseudonymisation. Personal data is limited to what is necessary for the purpose of processing and pseudonymised where the purpose allows.
2. Confidentiality
- Access control. System access uses federated identity and single sign-on (SSO), with the principle of least privilege applied.
- Confidentiality commitments. Personnel authorised to process personal data are bound by confidentiality obligations.
- Tenant isolation. Each tenant has a dedicated network (VPC) with workload separation; outbound traffic is routed through a controlled gateway.
3. Integrity, availability and resilience
- Infrastructure. Services are hosted on a tier-one cloud provider with service-availability guarantees.
- Monitoring and auditing. Systems are continuously monitored and observable, with an audit trail of operations.
4. Restoration of availability and access
- Backups. Databases are backed up automatically, with point-in-time restore capability.
- Recovery. Procedures are in place to restore the availability of and access to personal data in a timely manner following a physical or technical incident.
5. Regular verification of effectiveness
- Measures are reviewed periodically to test and assess their effectiveness.
- Vulnerabilities are managed and security updates are applied.
- Access and audit logs are reviewed.
6. Processing by artificial-intelligence models
- Third-party language models used are not trained on the controller's data.
- Processing by the model provider is carried out with training opt-out and a limited retention period (30 days).
- Providers acting as sub-processors are listed at avatia.ai/security/sub-processors.
7. Security incident management
- Avatia maintains an incident-response procedure and notifies the controller of any personal-data breach in accordance with the timeframes and conditions set out in the Agreement.
For any question regarding these measures or the processing of personal data, please contact dpo@avatia.ai.