Legal
EvRisko Security Annex
Effective date: 01 October 2026 · Last updated: 01 October 2026Privacy and Security
Provider applies the following technical controls for the EvRisko Application.
Technical controls
•Hashed password
•Self-service password reset
•Password strength requirements
•Session lifetime and revocation
•Encryption in transit: enabled
•Encryption at rest: enabled
•Multi-factor authentication
•Role-based access controls: admin and user role separation
•Administrative access logging: enabled
•Tenant isolation
•Account lockout after failed login attempts
•Event logging & event monitoring
•Backups and availability
•Automated tests & continuous integration
•Backups: daily
Hosting
Primary hosting region: Frankfurt
Subprocessors: Vercel, Railways, Supabase, Resend, Google