Security and trust

Data in the European Union, encryption, multi-factor authentication, action log, backups and export.

Compliance data includes risks, vulnerabilities, contracts and incidents. This page describes the commitments and the technical and organisational measures EVIDEVO uses to protect it.

  • EUData in the European UnionApplication, database, files and backups.
  • MFAProtected accessDistinct roles and multi-factor authentication.
  • LOGActions loggedEvery access and every change logged.
  • EXPORTPortable dataFull export at any time.

How data is protected

Four layers between a request and the data.

  1. 01

    Access

    • Multi-factor authentication
    • Distinct roles and permissions
    • Time-limited auditor access
  2. 02

    Application

    • Encryption in transit (TLS)
    • Permissions checked on every action
    • Action log
  3. 03

    Data

    • Separate space per customer
    • Encryption at rest
    • Deletion at contract end
  4. 04

    Continuity

    • Daily backups
    • Tested recovery
    • Continuous monitoring

Data centres in the European Union · no transfers to third countries

In detail

Commitments by area: data residency, access, data protection, operations.

Where the data lives

  • Application, database, files and backups hosted in data centres in the European Union.
  • No transfers to third countries to deliver the service.
  • List of sub-processors available on request at [email protected].

Access

  • Roles with distinct permissions for leads, owners, consultants and auditors.
  • Multi-factor authentication.
  • Logging of access to and actions on sensitive data.

Data protection

  • For data entered by customers, Karstia, which provides EVIDEVO, acts as a processor under Article 28 GDPR, on the basis of a data processing agreement.
  • Encryption in transit (TLS) and at rest.
  • Each customer's data logically separated from the others.
  • Full export at any time and deletion at the end of the contract within the agreed terms.

Operations

  • Infrastructure as code and tracked releases.
  • Daily backups and tested recovery procedures.
  • Vulnerability management and continuous service monitoring.

Artificial intelligence

Automatically generated suggestions are applied only after a person confirms them.

  • Some features suggest links between requirements and controls, flag incomplete evidence or prepare drafts for review.
  • Every suggestion shows the sources it is based on and is never applied without a person's confirmation.
  • Every confirmation or rejection stays in the decision log.
  • Customer data is not used to train models.

Documentation

Documents available for vendor assessments.

  • Data processing agreement (DPA)
  • List of sub-processors
  • Description of architecture and security measures
  • Answers to customer security questionnaires

Documentation is shared on request during the assessment.

What EVIDEVO does not do

EVIDEVO does not issue certifications, audit reports or legal conformity opinions. It organises the work and evidence that lead to those outcomes, which remain the responsibility of certification bodies, auditors and authorities.

Reporting a vulnerability

Security reports are handled confidentially. Contact details and the disclosure policy are published in the security.txt file.

Open security.txt →

Security questionnaires and questions

During the presentation, the team answers questionnaires and requests from security leads or procurement teams.

Let's talk