Security & Compliance

Svensk version

Technical and organisational safeguards Heqtic has in place to protect customer and prospect data. This description follows GDPR Art. 32 and NIS2 Art. 21.

1. Data encryption

• In transit: TLS 1.2+ mandatory between client, Vercel edge, and Supabase. HSTS enabled.
• At rest: AES-256 on the database via Supabase. File system encrypted on Vercel's infrastructure.

2. Access control

• Customer accounts: Password authentication via Supabase Auth. Registration is closed — accounts are created manually upon agreement.
• Admin accounts: Hardcoded list in environment variables. Middleware blocks all admin access at the edge level; server code double-validates.
• Service credentials: Stored only as server environment variables; never exposed in client bundles or version control.

3. Audit and traceability

Every administrative action on customer data is logged in an immutable audit table (generated, approved, changed, deleted, GDPR export, GDPR deletion, suppression list). Logs contain actor, action, target, and timestamp.

4. Data retention and deletion

• An admin can set automatic retention (3–24 months) on each ICP. A nightly cleanup deletes expired records and logs the event.
• Customers can request full deletion — see the privacy policy.
• The suppression list guarantees that a prospect who has objected to processing never reappears in future generations.

5. Incident handling (NIS2 Art. 23)

Suspected security incidents are reported to sam@heqtic.se. For significant incidents (unauthorised access to customer data, a leak of prospect data, a sub-processor incident):

• Affected customers are informed within 72 hours.
• Where required, the event is reported to the Swedish Authority for Privacy Protection (IMY) as a data-protection incident.
• Where required, the event is reported to the Swedish Civil Contingencies Agency (MSB) as a NIS2 incident.
• We send a follow-up incident report with root-cause analysis and remediation within 30 days.

6. Vulnerabilities and dependencies

• Third-party libraries are reviewed on updates. Security-related patches are prioritised.
• Security vulnerabilities can be reported confidentially to sam@heqtic.se.

7. Sub-processors

The sub-processors we rely on are listed on the sub-processor page, including regions and a link to each data processing agreement (DPA).

8. Open improvements

We are working on the following additions, which are not yet mandatory but raise the baseline:

• Two-factor authentication (MFA) for admin accounts.
• A self-service UI for customers to export and delete data.
• A formal vulnerability disclosure policy.