Data processing — Annex II — security measures

The measures below are implemented today. The security page describes each in more detail and is incorporated here by reference; where it and this annex differ, this annex is the contractual commitment. • Encryption: TLS in transit, with HTTP redirected to HTTPS and HSTS in production. Encryption at rest for both the database (Azure Database for PostgreSQL) and file storage (Azure Blob Storage). • Access control: Three levels, each able to override the one above: workspace role, per-table access, and per-field access. A hidden field stays hidden on every path out of the database — through relations, reports, search, export and AI answers alike. • Authentication: Passwordless sign-in links (256-bit tokens, stored hashed, 30-minute expiry, single use); optional two-factor authentication (TOTP, RFC 6238) which a workspace owner can require of everyone; Google and Microsoft single sign-on on the provider's verified subject identifier. Where passwords exist they are stored with PBKDF2-HMAC-SHA256, 100,000 iterations and a unique salt. • Secrets at rest: Two-factor seeds and third-party OAuth tokens are encrypted in the database rather than merely stored in it.