SimpleSecurity is currently in pre-launch. The operating Swedish company (aktiebolag) is under registration — org.nr [ORG-NR] will be inserted here once registration completes.
This Annex 1 describes the technical and organisational measures ("TOMs") implemented by SimpleSecurity in accordance with GDPR Art. 32, referenced from the Data Processing Agreement, Section 5(c).
1. Encryption & pseudonymisation
| Measure | Implementation |
|---|
| Encryption in transit | All traffic is HTTPS-only. CloudFront redirects HTTP to HTTPS; the API is served over HTTPS only. |
| Encryption at rest | All data stores are encrypted using AWS-managed encryption — DynamoDB server-side encryption and AES-256 for S3 buckets. |
| Payment card data | Handled entirely by Stripe; card data never touches SimpleSecurity systems. Stripe API keys are stored in AWS Secrets Manager. |
2. Confidentiality
| Measure | Implementation |
|---|
| Physical security | All infrastructure runs on AWS data centres in eu-north-1 (Stockholm), under the AWS shared-responsibility model. SimpleSecurity is fully serverless (Lambda, DynamoDB, S3, API Gateway, Cognito) with no long-lived servers to patch; runtime patching of the underlying platform is handled by AWS. |
| Authentication | AWS Cognito authentication. Password policy: minimum 12 characters including upper/lowercase letters, numbers and symbols. Account recovery only via verified email. |
| Multi-factor authentication | TOTP-based MFA available to all users; organisation administrators can enforce MFA for the whole organisation. |
| Adaptive security | Cognito advanced security is enforced: adaptive risk detection and compromised-credential checks. |
| Authorisation | Every data-plane API route requires a validated Cognito JWT via an API Gateway Cognito authorizer. Role-based access control with read/write/delete/execute permission tiers per service, group-based permissions, and per-user overrides. |
| Tenant isolation | Every customer's data is partitioned by tenant_id, the DynamoDB partition key on every table. Every query is scoped to the authenticated tenant; requests without a valid tenant fail closed (401). |
3. Integrity
| Measure | Implementation |
|---|
| Audit logging | AWS CloudTrail provides full, multi-region audit logging of all infrastructure/administrative API actions, with log-file integrity validation. Audit logs are retained 90 days in a dedicated encrypted bucket. |
| Application logging & tracing | Application logs are retained 30 days in CloudWatch. AWS X-Ray tracing is enabled on the API. |
| Change management | Infrastructure is defined and deployed as code (infrastructure-as-code), so changes are versioned and reviewable. |
4. Availability & resilience
| Measure | Implementation |
|---|
| Backup & point-in-time recovery | DynamoDB point-in-time recovery (PITR) is enabled on all tables, providing continuous backup and restore to any second within the last 35 days. |
| Multi-AZ resilience | DynamoDB, Lambda and S3 are multi-AZ regional services by default. |
| Background job resilience | Dead-letter queues and retry logic are used on background jobs. |
| Perimeter defence | AWS WAF sits in front of the application, using AWS managed rule sets (IP reputation, common attack patterns/OWASP-aligned, known bad inputs) plus rate limiting (2000 requests/IP per 5 minutes). |
| API throttling | API Gateway throttling: global limit of 100 req/s (burst 20); login/register endpoints tightened to 5 req/s (burst 2). |
| Monitoring & alerting | CloudWatch alarms on Lambda errors, API 5xx responses, dead-letter queue depth and DynamoDB errors alert the operations contact via SNS. A cost-anomaly guard is implemented via AWS Budgets. |
| Deletion protection | The Cognito user pool has deletion protection active. |
5. Data lifecycle & erasure
| Measure | Implementation |
|---|
| Automatic expiry | Monitoring history, downtime events, scan results, resolved findings, resolved incidents, change logs and notifications auto-expire via DynamoDB Time-To-Live. |
| Controller-configurable retention | Organisation administrators set the retention period for each telemetry category themselves, down to a documented minimum, under User Management → Data Retention. A nightly enforcement job applies a shortened window to data already stored, not only to new data. Individual services can be switched off entirely, which stops collection immediately. Full schedule and minimums: Data Retention & Deletion Policy. |
| Data minimisation over time | Identifiers are removed from retained telemetry where the analytic value does not require them — for example the names of systems recorded in daily dependency snapshots are stripped automatically after 90 days, leaving only the aggregate score. |
| Legal hold | An organisation administrator can suspend all scheduled deletion for their organisation, with a recorded reason, where evidence must be preserved for legal, regulatory or disciplinary proceedings (ISO/IEC 27001:2022 A.5.28). |
| Personnel-security records | Employee rosters for security-awareness training and policy acknowledgments follow the same controller-configurable schedule: offboarded-employee records auto-expire (default 90 days after employment end, maximum 365), and training/acknowledgment evidence is retained 430 days by default (minimum 430 days, configurable up to 3 years) as compliance evidence. Active-employee records never expire on a timer. Details: Data Retention & Deletion Policy. |
| Self-service erasure (GDPR Art. 17) | Organisation administrators can permanently delete the entire organisation — all users, assets, monitors, incidents, policies (including uploaded documents), vendor records and settings — from the dashboard (User Management → Security → Danger Zone), with typed confirmation. |
| Fallback erasure | Self-service deletion is the primary path. Only where no administrator can access the account is deletion carried out on written request to security@simplesecurity.se, actioned within 30 days. |
| Statutory retention exception | Billing records are retained for 7 years from the end of the calendar year in which the financial year ended, as required by the Swedish Bookkeeping Act (bokföringslagen 1999:1078). These records are held by our payment processor. |
6. Regular testing & evaluation
| Measure | Implementation |
|---|
| Continuous monitoring | CloudWatch alarms and SNS notifications provide ongoing operational monitoring of the platform (see Section 4). |
| Adaptive authentication risk checks | Cognito advanced security continuously evaluates sign-in risk and compromised-credential indicators. |
| Responsible disclosure | A responsible-disclosure channel is published at /.well-known/security.txt and via security@simplesecurity.se. |
| Dependency & platform currency | Dependencies and the underlying platform are continuously updated. SimpleSecurity applies its own CVE-intelligence scanning stack (the product's own vulnerability-scanning feature) to its own assets as well. |
7. Sub-processor measures
| Sub-processor | Measure |
|---|
| AWS (hosting & infrastructure) | Processing is governed by the AWS Data Processing Addendum (AWS DPA). |
| Stripe (payment processor) | Stripe is PCI-DSS certified and acts as an independent controller for card data; SimpleSecurity never receives or stores card data. |
| OVHcloud (business email hosting) | Processing is governed by the OVHcloud Data Processing Agreement; ISO 27001, 27017, 27018 & 27701 certified; mailboxes hosted in France (EU). |
| AWS Bedrock (AI-assisted support) | Personal identifiers in support-case text are masked with tokens before processing; no model-side data retention; all outbound replies undergo human review; EU-region inference enforced (Stockholm, eu-north-1); governed by the AWS Data Processing Addendum. |
| Cloudflare (DNS & inbound support-email routing Worker) | Processing is governed by the Cloudflare Data Processing Addendum and its incorporated Standard Contractual Clauses; the Worker parses only the text of the customer's reply email before forwarding it to SimpleSecurity's API over an HMAC-signed HTTPS request, and does not itself retain message content. |
See Annex 2 – Sub-processor list for the full current list and further detail.