Compliance & standards
Where we stand today. Nothing is described as certified until a certificate exists — readiness matrices are shared on request.
- GDPR Art. 28Available
DPA template v1.0 with Annexes A–C, English and Italian.
- EU data residencyIn place
Hosted in the EEA. Transfers on SCCs Module 2.
- ISO 27001:2022In preparation
Readiness matrix maintained; certification roadmap on file.
- SOC 2 Type IIPlanned
Type I assessment planned; no engagement booked yet.
- ISO 42001:2023Readiness
38 Annex A controls and 7 clauses mapped.
- Vulnerability disclosurePublished
RFC 9116 security.txt, with a 24-hour acknowledgement commitment.
Documents & policies
Public documents open directly. Everything else is released on request, under NDA where it carries audit detail.
- Data Processing Agreement template (EN / IT)GDPR Art. 28, v1.0 — Annex A scope, Annex B measures, Annex C sub-processorsOn requestRequest
- Privacy PolicyVersioned, with acceptance historyPublicOpen
- Terms of ServiceIncluding the Art. 1341 clauses for Italian customersPublicOpen
- Cookie NoticeVersioned; every cookie and similar technology we use, what it does, how long it is kept, and how to change your choicePublicOpen
- security.txt (RFC 9116)Machine-readable vulnerability-disclosure contactPublicOpen
- ISO 42001 readiness matrix38 Annex A controls and 7 main-body clauses, control by controlUnder NDARequest
Security controls
The technical and organisational measures of DPA Annex B, grouped the way a security questionnaire asks for them. Each one maps to a real control in the platform.
Data security
- Encryption at restAES-256 (Hetzner infra) + per-field Fernet for sensitive secrets (core/encryption.py)
- Encryption in transitTLS 1.2+ on all endpoints; HSTS pre-load eligible
- BackupsDaily pg_dump + on-host retention of at most 30 days + the last 7 pre-deploy snapshots
Access control
- AuthenticationPBKDF2/Argon2 password hashing + TOTP MFA (django_otp) + SAML SSO (Enterprise)
- AuthorizationRow-level tenant isolation via TenantAwareManager (1,318 LoC of dedicated isolation tests)
- Audit trailAppend-only AuditLog with DB-level immutability (10-year retention floor for AI-Act-scoped rows)
Application security
- Automated security scanningContainer and dependency scans run on every pipeline execution; a dynamic scan runs weekly
- Secret scanningEvery commit is screened for credentials before it can land (detect-secrets pre-commit gate)
- Dependency managementAutomated dependency updates against a pinned, reproducible lockfile
Operations
- Incident responseDocumented runbook (docs/deploy-recovery.md) + 72h breach-notification commitment in DPA §6.6
- Sub-processor governance30 days' notice before any sub-processor change, with a documented right to object (DPA §6.3)
- HostingEU data centres only, in Germany and Finland
Sub-processors
30-day pre-change notice committed via DPA §6.3. Tenants can object within the notice period; unresolved objections terminate the affected processing.
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Primary hosting (EU) | Helsinki, Finland — Hetzner Online GmbH (Germany) | GDPR-native (intra-EEA) |
| Anthropic, PBC | LLM provider (own-key tier) | United States | SCCs Module 2 |
| OpenAI, OpCo, LLC | LLM provider (own-key tier) | United States | SCCs Module 2 |
| Brevo SAS | Transactional email | France | GDPR-native (intra-EEA) |
| Functional Software, Inc. (Sentry) | Error tracking | United States | SCCs Module 2 |
Vulnerability Disclosure
We follow RFC 9116. The machine-readable contact + Encryption metadata is served at /.well-known/security.txt. Coordinated disclosure: report to ip@landingred.com; we acknowledge within 24h.
/.well-known/security.txtContact
For procurement questions, DPAs, or security inquiries: privacy@landingred.com. For vulnerability reports, see the dedicated section below + our RFC 9116 /.well-known/security.txt endpoint.
Email us