Data security

1. Access and data separation

Application mechanisms include authentication, roles and company/project access checks. Client data is logically separated; a separate database does not mean a separate physical server. Client administrators should grant only necessary permissions and remove access when collaboration ends.

2. Transmission and files

Production connections must use HTTPS/TLS. Files are held in private storage and access requires authorisation; signed links expire. Do not share them publicly. TLS protects transmission but does not promise end-to-end encryption that prevents the Operator or AI model reading submitted content.

3. Operational safeguards

The Operator’s duties follow Article 32 GDPR and the DPA, including access management, updates, recovery and evaluating safeguards. RPO, RTO, backup frequency/retention, at-rest encryption and recovery-test results require production verification. This page does not replace an individual SLA or establish certification.

4. Incident reports

Send data protection reports to privacy@struvo.pl and access problems to support@struvo.pl. Include the time, description, scope and a safe contact method. Do not send passwords, access keys or unnecessary third-party data. Coordinate vulnerability disclosure with support to reduce client risk, without restricting rights to notify competent authorities.