Security

Data security and IT infrastructure security is one of the key pillars of the system eAuditor Cloud. The Administrator exercises the utmost diligence to ensure compliance with the requirements GDPR, best industry practices, and information security standards. User data is protected through transmission encryption, access control, and continuous security monitoring.

The Administrator guarantees Service availability at the level of 99.90% on an annual basis.

Data location and protection

• All servers eAuditor Cloud are located in Poland, in data centers that meet the requirements of GDPR and national personal data protection regulations.

• Infrastructure location:

  • OVHcloud data center in Ożarów Mazowiecki (Kazimierza Kamińskiego 6, 05-850 Ożarów Mazowiecki, Poland) - a facility managed by OVHcloud sp. z o.o., which holds, among others, certifications ISO 27001, ISO 27017, ISO 27018, ISO 27701, as well as standards SOC 1/2/3 (as of 13.11.2025). More information: OVHcloud Compliance and Certifications

• Each Customer has their own dedicated database, which is not shared with other services or customers.

• Data is not transferred outside the European Economic Area (EEA).

• To ensure the highest level of security, the Service is regularly subjected to penetration tests and security audits conducted by independent specialized entities. More at the link.

Data is not transferred outside the European Economic Area (EEA). The exception applies only to payment processing data, which is processed by Stripe on servers located also outside the EEA (including in the United States). This includes only the information needed to process payments, such as: buyer details, billing data, subscription information, and transaction details.

This does not apply to any data collected by the eAuditor cloud system, such as inventory, activity monitoring, security policies, disk encryption, DLP data, or any technical information from the Customer's computers – these remain exclusively on servers in Poland.

More information about the security of payment processing can be found in the section Payment Security and Billing Operator.

Backups and data recovery

The scope and availability of backups depend on the selected subscription plan:

• FREE plan – backups are not available.

• INV100 plans and ACT200 – the system performs 1 backup, stored in the same location where the eAuditor cloud infrastructure operates, namely in the OVHcloud data center in Ożarów Mazowiecki.

• DLP300 plan – available are 2 backups:

  • one stored in Ożarów Mazowiecki,

  • the other in a separate location within the European Union, meeting the security and compliance standards described above.

Backups are used exclusively for data recovery in the event of a failure or loss of system availability.

Encryption and data transmission

• The data transmission process is secured using SSL/TLS, ensuring the confidentiality and integrity of communication between the user and the service.

• Communication between system components (eAgent and eServer ) takes place using the TLS 1.3.

• Both eAgent, and eServer have their own SSL certificates with a 4096-bit key length, which ensures a very high level of data transmission security.

• Encryption covers both real-time data transmission and communication during authentication processes and exchange of system information.

Storage and deletion of data

• Data sent to the eAuditor cloud Service are recorded on the Customer Account and can be deleted by the Customer at any time.

• After the Service is terminated, the Customer Account is blocked for 14 days, after which the data are permanently deleted (on the 15th day after account closure), subject to obligations arising under applicable law.

• After permanent deletion, data recovery is technically impossible.

• The Administrator processes the Customer's data after the Account is closed only to the extent and for the period necessary to fulfill legal obligations, in particular those arising from accounting and tax regulations.

Authentication and access

• Logging in to the console eAuditor Cloud takes place using multi-factor authentication (MFA).

• The system is integrated with applications such as Google Authenticator and Microsoft Authenticator.

• The account administrator can enforce MFA for all organization users.

• The system works with Microsoft Entra ID, enabling centralized identity and access management.

• Access to system functions and data can be managed based on roles (RBAC).

Service updates

• New software versions eAuditor Cloud and updates (patches) are made available to users automatically.

• Updates include security fixes, performance improvements, and new functionality.

Payment Security and Billing Operator

• As part of the billing model, we use the operator Stripe, which also affects the security of the eAuditor cloud system.

• Stripe is a certified Service Provider Level 1 compliant with PCI DSS 4.0, which means the highest level of security in processing payment card data.

• Stripe holds compliance reports of the SOC 1 and SOC 2 Type II, and all API connections and the dashboard operate exclusively over the secure HTTPS/TLS channel. More.

• As a result, your payment data and subscription information are processed by an operator that meets stringent industry standards.

User responsibilities for security

In order to maintain secure use of the Service, the following rules apply to all persons with access to the Customer Account, both Users, and Account Administrators (as defined in the Service Terms):

• Use the current version of the recommended web browsers: Chrome, Edge, Firefox or Safari.

• Regularly update the browser to the latest release version.

• Remember that using browsers other than the recommended ones may cause the Service to malfunction.

• Protect access credentials and do not share them with unauthorized persons.

• Use the Service in accordance with applicable law and the rules set out in the Service Terms.

Additional obligations of the Account Administrator:

• Managing User access and controlling the permissions granted.

• Overseeing the configuration of the Customer Account.

• Responding to suspected unauthorized access or security breaches.

More information can be found in the eAuditor Cloud Service Terms.