Security
These are the technical and organisational measures in place today. This page is Annex 2 of our Data Processing Agreement.
| Area | Measure |
|---|---|
| Separation of customers and clients | Every client company has its own workspace. Access is checked on every request, and automated tests confirm that one client cannot reach another’s documents. |
| Sign-in | No passwords: single-use email links valid for 30 minutes. Sessions are stored only as SHA-256 hashes. Requests from other websites are refused. |
| Encryption in transit | HTTPS everywhere, with automatically renewed certificates and HSTS. |
| Integrity of the record | Every action is written to an append-only log. Each entry includes the SHA-256 hash of the previous one, and the database refuses edits and deletions of the log. Every file gets a SHA-256 fingerprint on upload. |
| Storage | Documents are kept in EU-jurisdiction object storage with a 6-year lock against deletion or overwrite. |
| Backups | Daily backup of the whole server, and a daily database copy sent to a second provider every 6 hours and kept 90 days. |
| Server access | SSH keys only, password login disabled; firewall open only for SSH, HTTP and HTTPS; brute-force protection; automatic security updates. |
| Secrets | Keys and passwords live only on the server, never in the code repository. |
| Monitoring | External availability check every 5 minutes, with alerts. |
Reporting a vulnerability
If you find a security problem, write to hello@pescada.io. Please do not test against other customers’ data. We reply within two working days.