Competency Acquisition Platform
EN
Book a demo
Security and Compliance

How we protect your factory data

Competency Acquisition Platform is built for HR managers who answer to committees, auditors and inspectors. We document explicitly what is implemented and what is in preparation so your risk team and company DPO have clear answers.

Authentication and sessions

  • Passwords hashed with bcrypt (cost factor 12).
  • Short JWT: 30-minute TTL, refresh via explicit login.
  • Password policy: at least 10 characters; common passwords, sequences and passwords containing the email, name or company are refused; passwords are stored only as bcrypt hashes.
  • Password reset via signed token with rate limiting and enumeration protection (generic response for unknown emails).
  • GDPR self-service export (Art. 20) available from the user profile.

Tenant isolation

  • Every authenticated request carries a tenant_id derived from the JWT, the sole source of truth.
  • The tenant_id column is first-class on every business table and part of every composite index.
  • A dedicated isolation test suite runs on every release; scope covers 13+ cross-tenant scenarios.

Append-only audit trail

  • SQLAlchemy event listeners block UPDATE and DELETE on audit tables.
  • Every business mutation writes an immutable record with who / what / when / diff.
  • The audit is fully exportable to CSV, filterable by operator and time window.

GDPR and transfers

  • Self-service Art. 20 export within 30 minutes of request.
  • Dedicated DPO for data-subject requests (access, portability, erasure).
  • DPA template available on request, digitally signable before the commercial contract.
  • Hosted exclusively in the EU (Hetzner FSN or HEL, or equivalent).
  • No third-party analytics without granular consent (ePrivacy-compliant cookie banner).

Backup and recovery

  • Database snapshot at 03:00 UTC daily, 90-day retention.
  • Offsite on Cloudflare R2 in a dedicated bucket with separate credentials.
  • Monthly restore test from a random snapshot for validation.
  • Stated objectives: RTO 4 hours, RPO 24 hours.

Certifications and attestations

  • GDPR compliant: implemented, exportable in the DPA.
  • ISO 27001: in preparation, target 2027.
  • We do not claim certifications we do not yet hold: ISO 27001 is in preparation, and the first penetration test is planned for Q2 2027.

Downloadable documentation