Security Manifest

Last updated: January 9th, 2026

Purpose & Scope

This manifest defines security controls for our preventive health SaaS platform processing personal health data under GDPR Article 32. It applies to all systems, personnel, and third parties handling user data.

Data Protection Principles

Data Minimization:
Collect only data necessary for service delivery
Implement purpose limitation at design stage
Regular data retention reviews with automated purging

Lawful Processing:
Explicit consent mechanisms with granular controls
Legitimate interest assessments documented for secondary processing
Data Processing Agreements (DPAs) with all processors

Data Subject Rights:
Automated workflows for access, portability, erasure requests (30-day SLA)
Right to rectification via user portal
Objection and restriction mechanisms in place

Technical Security Controls

Encryption:
In Transit: TLS 1.3 minimum for all connections
At Rest: AES-256 encryption for databases and file storage
Key Management: HSM-backed key rotation every 90 days

Access Control:
Zero-trust architecture with role-based access control (RBAC)
Multi-factor authentication mandatory for all accounts
Principle of least privilege enforced via quarterly access reviews
Privileged access management (PAM) for administrative functions

Network Security:
Network segmentation isolating production, staging, and development
Web Application Firewall (WAF) with OWASP Top 10 protection
DDoS mitigation and rate limiting
Regular penetration testing (minimum annual)

Application Security:
Secure SDLC with mandatory code reviews and SAST/DAST scanning
Dependency vulnerability scanning in CI/CD pipeline
Input validation and output encoding across all interfaces
API security with OAuth 2.0 and rate limiting

Organizational Controls

Personnel Security:
Background checks for personnel with data access
Mandatory security awareness training (onboarding + annual refresh)
Confidentiality agreements for all staff and contractors
Immediate access revocation upon termination

Vendor Management:
Due diligence assessments for all processors
Contractual DPAs with GDPR Article 28 requirements
Annual vendor security reviews
Sub-processor notification and approval process

Incident Response:
24/7 security monitoring with SIEM
Documented incident response plan with defined roles
GDPR breach notification within 72 hours to supervisory authority
Root cause analysis and remediation tracking

Business Continuity

Recovery Time Objective (RTO): 4 hours
Recovery Point Objective (RPO): 1 hour
Encrypted backups with geographic redundancy
Annual disaster recovery testing
High availability architecture (99.9% uptime SLA)

Data Residency & Transfers

Primary data storage within EU/EEA
International transfers only via Standard Contractual Clauses (SCCs) or adequacy decisions
Transfer Impact Assessments (TIAs) for non-EU processors
Data localization compliance with member state requirements

Privacy by Design

Data Protection Impact Assessments (DPIAs) for high-risk processing
Privacy requirements integrated in product development lifecycle
Pseudonymization and anonymization where feasible
Privacy-preserving analytics methods

Compliance & Audit

Regular GDPR compliance audits

Monitoring & Logging

Centralized logging with 13-month retention
Audit trails for all data access and modifications
Automated compliance monitoring and alerting
Quarterly internal security assessments

Continuous Improvement

This manifest is reviewed annually and updated to reflect:
Emerging threats and vulnerabilities
Regulatory changes and guidance
Lessons learned from incidents and audits
Technology and architectural evolution