BUNCH

Security Overview

1. Organizational Procedures • Record of Processing Activities accessible by the Data Protection team in order to identify and isolate data incidences and trigger contingency and escalation measures • Code of Conduct and Data Protection signed by all employees involved in client operations • Data Breach Protocol enabled to all the employees involved in client operations • Regular training of employees on data privacy measures. 2. Pseudonymisation and Encryption • Encrypted data transfer between client and server • Pseudonymisation of personal data for development and related testing purposes 3. On-Premises Confidentiality • Network security controls • Enterprise firewall • Intrusion detection systems, and other traffic and event correlation procedures designed to protect systems from unauthorized access • Whitelisted-only devices policy on-premises and restricted remote access • Usage of anti-virus software including automated updates 4. Entry Control • Rigorous office access concept including multiple locked doors with keys and/or biometric access available only to regular employees and cleaning staff • Access to the office for visitors only accompanied by an employee • Video surveillance of the main entry door and the entry area. • Documented system access concept including user access removals • Effective entry authorization controls through an adequate locking system (e.g., security key with documented key management, electronic locking systems with documented authorizations management) 5. Access Control • Automatically activated and password-protected computer locking • Two-factor authentication required for employees exposed to customer data • No access to personal data in a non-authenticated way • Prevention of brute force password entry attempts to BUNCH • Restriction to account access to company network for BUNCH customers possible • Logging of accesses (including failed ones) to the application • Detailed process in place with customers to ensure data

Security Credentials