Security Policy

Elevon implements technical and organisational measures appropriate to the risk of processing, in accordance with Art. 32 GDPR.

1. Access control

• Role-based access control with least-privilege principles.
• Multi-factor authentication for administrative access.
• Personnel bound by confidentiality obligations.

2. Data protection

• Encryption in transit (TLS) and at rest.
• Row-level security isolating each company's data.
• Data minimisation — only data needed for the service is processed.

3. Operational security

• Logging and monitoring of access and system events.
• Regular security review and vulnerability management.
• Secure software development practices.

4. Incident response

We maintain an incident response process. In the event of a personal data breach, we notify affected customers without undue delay to enable compliance with Art. 33 GDPR.

5. Business continuity

We maintain backup and recovery procedures to support availability and resilience of the platform.

6. Sub-processors

Our sub-processors are bound by GDPR-compliant agreements. See our Sub-Processors list.

7. Reporting vulnerabilities

Security researchers can report vulnerabilities to info.elevon@proton.me. We appreciate responsible disclosure.