Security and data handling.

Cloud

Microsoft Azure, North Europe (Dublin) region, on ISO 27001 and SOC 2 certified infrastructure.

Residency

All primary data is stored within the EEA. No personal data is stored outside the EEA without standard contractual clauses.

Availability

Auto-scaling with multi-zone redundancy. Target uptime of 99.9% on Enterprise.

Backup

Automated daily encrypted database backups, kept for 30 days and tested quarterly.

Sign-in

OAuth 2.0 and OpenID Connect, with short-lived access tokens.

MFA

Multi-factor authentication is enforced for all platform access.

Roles

Role-based access at API and interface level, on the minimum-privilege principle.

Tenants

Row-level security in the database prevents any cross-tenant data access.

In transit

TLS 1.2 or newer for all communication.

At rest

AES-256 encryption for all stored data.

Keys

Managed in Azure Key Vault and rotated annually. No secrets in code.

Sign-ins, data access, changes and admin actions are logged with user, action, time, device and outcome. Log entries are hash-chained and cannot be altered or deleted, including by admins.

In the ledger itself, corrections are new events that reference the original. History is never overwritten.

Edgeon AS acts as data processor for customer data under GDPR Article 28. Questions about privacy go to privacy@edgeon.no.

• Data processing agreement
• Privacy policy
• Terms of service
• Cookie policy