Data and security
What this application does to protect the data it holds and to respect the rights of the people it concerns, and the text of law each measure answers to.
| Measure | What it does | Text of law |
|---|---|---|
| Personal accounts | Each person signs in with their own account, by password or by passkey. A password is never stored: only a one-way fingerprint of it is kept. | GDPR, article 32 |
| Access by role | Administrators give each person their roles, and the roles decide what each person may see and change. The server checks it on every request. | GDPR, articles 25 and 32 |
| Your data, downloaded or erased | From their profile, each person downloads everything the application holds about them, in files they can reuse, and can erase their account. | GDPR, articles 15, 17 and 20 |
| Each organisation apart | Each organisation the application serves sees only its own accounts and records. | GDPR, article 32 |
| An organisation's data, taken away or erased | An administrator downloads everything held for an organisation, in files it can reuse elsewhere, and can erase the organisation with its accounts. | Data Act, article 23 |
| Access record by record | The server decides, record by record, which records each person may read and change, following the rules the application declares. | GDPR, articles 25 and 32 |
| Privacy notice | A public page says what the application does with personal data: why, on what legal basis, for how long, who reads it and who processes it. It is written from the application itself, so it follows every change. | GDPR, articles 13 and 14 |
| Requests about personal data | A person's request to see, correct, erase or receive their data, to restrict its use or to object to it, is recorded with the deadline the law sets and followed until it is answered. | GDPR, articles 12 and 15 to 21 |
| Kept no longer than needed | Records whose retention period is declared are erased or anonymised by the application once it has run out. | GDPR, article 5(1)(e) |
| Record of processing | The record of what the organisation does with personal data is written from the application and kept up to date with it. | GDPR, article 30 |
| Impact assessment (Draft — being validated) | The application screens itself against the criteria that call for an impact assessment, and writes a draft of it with its purposes, its data and the measures it takes, for the organisation to complete. | GDPR, article 35 |
| Reporting a vulnerability | The application's code says where to report a vulnerability, and lists what the application is made of. | Cyber Resilience Act, article 13 |