> For the complete documentation index, see [llms.txt](https://eaclouddoc.eauditor.eu/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eaclouddoc.eauditor.eu/eacloud-docs-en/system/security.md). # Security Data security and IT infrastructure security is one of the key pillars of the system **eAuditor Cloud**. The Administrator exercises the utmost diligence to ensure compliance with the requirements **GDPR**, best industry practices, and information security standards.\ User data is protected through transmission encryption, access control, and continuous security monitoring.
The Administrator guarantees Service availability at the level of **99.90% on an annual basis**. ## **Data location and protection** * All servers **eAuditor Cloud** are located in **Poland**, in data centers that meet the requirements of **GDPR** and national personal data protection regulations. * Infrastructure location: * **OVHcloud data center in Ożarów Mazowiecki (Kazimierza Kamińskiego 6, 05-850 Ożarów Mazowiecki, Poland) -** a facility managed by [**OVHcloud sp. z o.o.**](https://www.ovhcloud.com/pl/), which holds, among others, certifications **ISO 27001, ISO 27017, ISO 27018, ISO 27701**, as well as standards **SOC 1/2/3** (as of 13.11.2025). \ More information: [OVHcloud Compliance and Certifications](https://www.ovhcloud.com/pl/compliance/) * Each Customer has **their own dedicated database**, which is not shared with other services or customers. * Data is not transferred outside **the European Economic Area (EEA)**. * To ensure the highest level of security, the Service is regularly subjected to **penetration tests** and **security audits** conducted by independent specialized entities. More at [the link](https://www.eauditor.eu/cloud-trust). {% hint style="warning" %} Data is not transferred outside the European Economic Area (EEA). **The exception applies only to payment processing data**, which is processed by Stripe on servers located also outside the EEA (including in the United States). This includes only the information needed to process payments, such as: buyer details, billing data, subscription information, and transaction details. **This does not apply to any data collected by the eAuditor cloud system**, such as inventory, activity monitoring, security policies, disk encryption, DLP data, or any technical information from the Customer's computers – these remain exclusively on servers in Poland. More information about the security of payment processing can be found in the section [**Payment Security and Billing Operator**](#bezpieczenstwo-platnosci-i-operatora-rozliczen). {% endhint %} ### Backups and data recovery The scope and availability of backups depend on the selected subscription plan: * **FREE plan** – backups are not available. * **INV100 plans** and **ACT200** – the system performs **1 backup**, stored in the same location where the eAuditor cloud infrastructure operates, namely in **the OVHcloud data center in Ożarów Mazowiecki**. * **DLP300 plan** – available are **2 backups**: * one stored in **Ożarów Mazowiecki**, * the other in **a separate location within the European Union**, meeting the security and compliance standards described above. Backups are used exclusively for data recovery in the event of a failure or loss of system availability. ## **Encryption and data transmission** * The data transmission process is secured using **SSL/TLS**, ensuring the confidentiality and integrity of communication between the user and the service. * Communication between system components (**eAgent** and **eServer** ) takes place using the **TLS 1.3**. * Both **eAgent**, and **eServer** have their own **SSL certificates with a 4096-bit key length**, which ensures a very high level of data transmission security. * Encryption covers both real-time data transmission and communication during authentication processes and exchange of system information. ## **Storage and deletion of data** * Data sent to **the eAuditor cloud Service** are recorded on **the Customer Account** and can be deleted by the Customer at any time. * After the Service is terminated, the Customer Account is blocked for 14 days, after which the data are **permanently deleted (on the 15th day after account closure)**, subject to obligations arising under applicable law. * After permanent deletion, data **recovery is technically impossible**. * The Administrator processes the Customer's data after the Account is closed **only to the extent and for the period necessary to fulfill legal obligations**, in particular those arising from accounting and tax regulations. ## **Authentication and access** * Logging in to the console **eAuditor Cloud** takes place using **multi-factor authentication (MFA)**. * The system is integrated with applications such as **Google Authenticator** and **Microsoft Authenticator**. * The account administrator can enforce MFA for all organization users. * The system works with **Microsoft Entra ID**, enabling centralized identity and access management. * Access to system functions and data can be managed based on **roles (RBAC)**. ## **Service updates** * New software versions **eAuditor Cloud** and updates (patches) are made available to users automatically. * Updates include security fixes, performance improvements, and new functionality. ## **Payment Security and Billing Operator** * As part of the billing model, we use the operator **Stripe**, which also affects the security of the eAuditor cloud system. * Stripe is a certified [**Service Provider Level 1 compliant with PCI DSS 4.0**](https://docs.stripe.com/security), which means the highest level of security in processing payment card data. * Stripe holds compliance reports of the **SOC 1 and SOC 2 Type II**, and all API connections and the dashboard operate exclusively over the secure HTTPS/TLS channel. [More.](https://docs.stripe.com/security/guide) * As a result, your payment data and subscription information are processed by an operator that meets stringent industry standards. ## **User responsibilities for security** In order to maintain secure use of the Service, the following rules apply to all persons with access to the Customer Account, both **Users**, and **Account Administrators** (as defined in the Service Terms): * Use the current version of the recommended web browsers: **Chrome, Edge, Firefox** or **Safari**. * Regularly update the browser to the latest release version. * Remember that using browsers other than the recommended ones may cause the Service to malfunction. * Protect access credentials and do not share them with unauthorized persons. * Use the Service in accordance with applicable law and the rules set out in the Service Terms. **Additional obligations of the Account Administrator:** * Managing User access and controlling the permissions granted. * Overseeing the configuration of the Customer Account. * Responding to suspected unauthorized access or security breaches. More information can be found in the [**eAuditor Cloud Service Terms**](https://app.eauditor.eu/register). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://eaclouddoc.eauditor.eu/eacloud-docs-en/system/security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.