CAP APP
EN
Book a demo
Security and Compliance

How we protect your factory data

CAP APP is built for HR managers who answer to committees, auditors and inspectors. We document explicitly what is implemented and what is in preparation so your risk team and company DPO have clear answers.

Authentication and sessions

  • Passwords hashed with bcrypt (cost factor 12).
  • Short JWT: 30-minute TTL, refresh via explicit login.
  • Password policy: minimum 12 characters, breached-password list check.
  • Password reset via signed token with rate limiting and enumeration protection (generic response for unknown emails).
  • GDPR self-service export (Art. 20) available from the user profile.

Tenant isolation

  • Every authenticated request carries a tenant_id derived from the JWT — the sole source of truth.
  • The tenant_id column is first-class on every business table and part of every composite index.
  • A dedicated isolation test suite runs on every release; scope covers 13+ cross-tenant scenarios.

Append-only audit trail

  • SQLAlchemy event listeners block UPDATE and DELETE on audit tables.
  • Every business mutation writes an immutable record with who / what / when / diff.
  • The audit is fully exportable to CSV, filterable by operator and time window.

GDPR and transfers

  • Self-service Art. 20 export within 30 minutes of request.
  • Dedicated DPO for data-subject requests (access, portability, erasure).
  • DPA template available on request, digitally signable before the commercial contract.
  • Hosted exclusively in the EU (Hetzner FSN or HEL, or equivalent).
  • No third-party analytics without granular consent (ePrivacy-compliant cookie banner).

Backup and recovery

  • Database snapshot at 03:00 UTC daily, 90-day retention.
  • Offsite on Cloudflare R2 in a dedicated bucket with separate credentials.
  • Monthly restore test from a random snapshot for validation.
  • Stated objectives: RTO 4 hours, RPO 24 hours.

Certifications and attestations

  • GDPR compliant: implemented, exportable in the DPA.
  • ISO 27001: in preparation, target 2027.
  • SOC 2 Type I: in preparation, target 2027.
  • We do not claim certifications we do not yet hold. Live status on the Trust Center page.

Downloadable documentation