Data processing — Annex II — security measures (2)

• Session security: HttpOnly, SameSite-restricted, secure cookies; sign-out-everywhere; email alerts on new-device sign-in and on security-setting changes. • Resilience to attack: Per-endpoint rate limiting, per-account lockout after repeated failures, server-side antiforgery validation on state-changing requests, and browser hardening headers including a content-security policy. • File handling: Uploads are never written to a publicly served directory and are readable only through an endpoint that checks permission on the owning record first. A file's URL is not a capability. • Recoverability: Records are soft-deleted to Trash rather than destroyed; changes are captured as events giving an audit trail of what changed and when; backups are maintained with the expiry window in section 12. • Segregation: Customer data is separated by workspace, and every query is scoped by membership; permissions are resolved once, server-side, and every surface reads that same resolved view. • Personnel: Contractual confidentiality obligations and role-limited access, as in section 05.