SimpleSecurity is currently in pre-launch. The operating Swedish company (aktiebolag) is under registration — org.nr [ORG-NR] will be inserted here once registration completes.
This Annex 1 describes the technical and organisational measures ("TOMs") implemented by SimpleSecurity in accordance with GDPR Art. 32, referenced from the Data Processing Agreement, Section 5(c).
1. Encryption & pseudonymisation
| Measure | Implementation |
|---|
| Encryption in transit | All traffic is HTTPS-only. CloudFront redirects HTTP to HTTPS; the API is served over HTTPS only. |
| Encryption at rest | All data stores are encrypted using AWS-managed encryption — DynamoDB server-side encryption and AES-256 for S3 buckets. |
| Payment card data | Handled entirely by Stripe; card data never touches SimpleSecurity systems. Stripe API keys are stored in AWS Secrets Manager. |
2. Confidentiality
| Measure | Implementation |
|---|
| Physical security | All infrastructure runs on AWS data centres in eu-north-1 (Stockholm), under the AWS shared-responsibility model. SimpleSecurity is fully serverless (Lambda, DynamoDB, S3, API Gateway, Cognito) with no long-lived servers to patch; runtime patching of the underlying platform is handled by AWS. |
| Authentication | AWS Cognito authentication. Password policy: minimum 12 characters including upper/lowercase letters, numbers and symbols. Account recovery only via verified email. |
| Multi-factor authentication | TOTP-based MFA available to all users; organisation administrators can enforce MFA for the whole organisation. |
| Adaptive security | Cognito advanced security is enforced: adaptive risk detection and compromised-credential checks. |
| Authorisation | Every data-plane API route requires a validated Cognito JWT via an API Gateway Cognito authorizer. Role-based access control with read/write/delete/execute permission tiers per service, group-based permissions, and per-user overrides. |
| Tenant isolation | Every customer's data is partitioned by tenant_id, the DynamoDB partition key on every table. Every query is scoped to the authenticated tenant; requests without a valid tenant fail closed (401). |
3. Integrity
| Measure | Implementation |
|---|
| Audit logging | AWS CloudTrail provides full, multi-region audit logging of all infrastructure/administrative API actions, with log-file integrity validation. Audit logs are retained 90 days in a dedicated encrypted bucket. |
| Application logging & tracing | Application logs are retained 30 days in CloudWatch. AWS X-Ray tracing is enabled on the API. |
| Change management | Infrastructure is defined and deployed as code (infrastructure-as-code), so changes are versioned and reviewable. |
4. Availability & resilience
| Measure | Implementation |
|---|
| Backup & point-in-time recovery | DynamoDB point-in-time recovery (PITR) is enabled on all tables, providing continuous backup and restore to any second within the last 35 days. |
| Multi-AZ resilience | DynamoDB, Lambda and S3 are multi-AZ regional services by default. |
| Background job resilience | Dead-letter queues and retry logic are used on background jobs. |
| Perimeter defence | AWS WAF sits in front of the application, using AWS managed rule sets (IP reputation, common attack patterns/OWASP-aligned, known bad inputs) plus rate limiting (2000 requests/IP per 5 minutes). |
| API throttling | API Gateway throttling: global limit of 100 req/s (burst 20); login/register endpoints tightened to 5 req/s (burst 2). |
| Monitoring & alerting | CloudWatch alarms on Lambda errors, API 5xx responses, dead-letter queue depth and DynamoDB errors alert the operations contact via SNS. A cost-anomaly guard is implemented via AWS Budgets. |
| Deletion protection | The Cognito user pool has deletion protection active. |
5. Data lifecycle & erasure
| Measure | Implementation |
|---|
| Automatic expiry | Monitoring history, scan results and notifications auto-expire via DynamoDB TTL. |
| Self-service erasure (GDPR Art. 17) | Organisation administrators can permanently delete the entire organisation — all users, assets, monitors, incidents, policies (including uploaded documents), vendor records and settings — from the dashboard (User Management → Security → Danger Zone), with typed confirmation. |
| Written-request erasure | Deletion is also honoured on written request to security@simplesecurity.se, actioned within 30 days. |
| Statutory retention exception | Billing records are retained 7 years, as required by the Swedish Bookkeeping Act (bokföringslagen 1999:1078). |
6. Regular testing & evaluation
| Measure | Implementation |
|---|
| Continuous monitoring | CloudWatch alarms and SNS notifications provide ongoing operational monitoring of the platform (see Section 4). |
| Adaptive authentication risk checks | Cognito advanced security continuously evaluates sign-in risk and compromised-credential indicators. |
| Responsible disclosure | A responsible-disclosure channel is published at /.well-known/security.txt and via security@simplesecurity.se. |
| Dependency & platform currency | Dependencies and the underlying platform are continuously updated. SimpleSecurity applies its own CVE-intelligence scanning stack (the product's own vulnerability-scanning feature) to its own assets as well. |
7. Sub-processor measures
| Sub-processor | Measure |
|---|
| AWS (hosting & infrastructure) | Processing is governed by the AWS Data Processing Addendum (AWS DPA). |
| Stripe (payment processor) | Stripe is PCI-DSS certified and acts as an independent controller for card data; SimpleSecurity never receives or stores card data. |
See Annex 2 – Sub-processor list for the full current list and further detail.