Technical and Organizational Measures

View the German version of this page

Expanded Technical and Organizational Measures (TOMs)

The Processor commits to implementing advanced security features and a robust organizational framework to ensure the protection of personal data. The following practices form the foundation of its approach:

The Processor secures all data during transfer using TLS 1.3 protocols and at rest with AES-256 encryption, ensuring that data remains unreadable to unauthorized parties. Encryption keys are managed through hardware security modules (HSMs) or trusted cloud key management systems, such as AWS KMS or equivalent, ensuring an additional layer of protection.

Access control is enforced through multi-factor authentication (MFA) and role-based access policies, ensuring that only authorized personnel with a legitimate need can access the data. System access is continuously monitored through automated logging mechanisms, with audit trails stored securely to allow for review and compliance checks.

To prevent unauthorized access, the Processor deploys network segmentation and virtual private networks (VPNs) for remote connections. Firewalls and intrusion detection systems (IDS) are used to monitor and mitigate potential threats in real time. Additional safeguards include endpoint protection for all devices interacting with the data.

The Processor conducts regular vulnerability assessments and penetration testing to identify and address potential weaknesses in its infrastructure. Systems are updated and patched promptly to mitigate newly discovered vulnerabilities, and redundant backup mechanisms are implemented to ensure data availability in the event of an incident.

Organizationally, the Processor prioritizes security awareness by training employees on data protection principles and incident response protocols. Employees are required to participate in regular refresher courses, ensuring they remain informed about evolving threats and compliance obligations. An incident response team is on standby to address any potential breaches, following a predefined containment and notification process.

The Processor adheres to a strict data retention policy. Data is retained only for the duration necessary to fulfill processing purposes and is securely deleted or anonymized once those purposes are complete. Storage environments are subject to physical security measures, including biometric access controls and 24/7 surveillance.

These measures are supplemented by continuous monitoring of systems for anomalies, ensuring proactive identification and mitigation of risks before they escalate.