Struvo · Legal information

# Security

The key principles protecting accounts, documentation and photos in Struvo.

# Data security

## 1. Access and data separation

Application mechanisms include authentication, roles and company/project access checks. Client data is logically separated; a separate database does not mean a separate physical server. Client administrators should grant only necessary permissions and remove access when collaboration ends.

## 2. Transmission and files

Production connections must use HTTPS/TLS. Files are held in private storage and access requires authorisation; signed links expire. Do not share them publicly. TLS protects transmission but does not promise end-to-end encryption that prevents the Operator or AI model reading submitted content.

## 3. Operational safeguards

The Operator’s duties follow Article 32 GDPR and the [DPA](/dpa), including access management, updates, recovery and evaluating safeguards. RPO, RTO, backup frequency/retention, at-rest encryption and recovery-test results require production verification. This page does not replace an individual SLA or establish certification.

## 4. Incident reports

Send data protection reports to `privacy@struvo.pl` and access problems to `support@struvo.pl`. Include the time, description, scope and a safe contact method. Do not send passwords, access keys or unnecessary third-party data. Coordinate vulnerability disclosure with support to reduce client risk, without restricting rights to notify competent authorities.