Technische und organisatorische Massnahmen

Last updated: 13 August 2026

Important notice

This document describes the technical and organizational measures under Article 32 GDPR that apply to AssetObserve. It is an annex to the Data Processing Agreement. It is a draft: every measure below must be checked against the deployment as it is actually operated before the document is published or attached to a signed agreement. A measure that is not implemented must be removed rather than softened.

Physical access control

The service runs on managed infrastructure operated by the hosting subprocessor named in the Subprocessor List. Physical access to the data centre, including entry controls, visitor management, and equipment disposal, is the responsibility of that provider and is covered by its own certifications. The processor operates no customer-facing hardware of its own.

System access control

• Individual named accounts; shared logins are not used
• Password hashing with a modern key-derivation function, never reversible storage
• Optional time-based multi-factor authentication for workspace accounts, and enterprise single sign-on through OIDC or SAML where the customer requires it
• Server-side sessions that can be revoked individually, with automatic expiry
• Rate limiting and abuse protection on authentication endpoints to slow credential-guessing
• Administrative access to the production host restricted to key-based SSH from named operators

Data access control

• Role-based authorization with the ordered roles auditor, viewer, operator, admin, and owner, enforced in the application rather than in the interface alone
• A separate platform administrator role for operator back-office functions, kept distinct from customer workspace roles
• Scan credentials stored in an encrypted credential vault; secrets are never written to logs or reports
• An append-only audit log recording the actor, the affected workspace, the action, the request identifier, and the source address, retained for a configurable period

Separation control

Every tenant record is scoped to its workspace, and queries are constrained by that scope. Partner and multi-workspace access is granted only through explicit, recorded links. Production, staging, and development environments are separated and do not share data.

Transfer control

• Transport encryption for all external connections, with certificates managed and renewed automatically
• HTTP security headers, including a content security policy, and cross-site request forgery protection on state-changing requests
• Agent traffic authenticated with per-agent enrollment tokens that can be revoked individually
• Collection is read-only by design: the scanner does not exploit, brute-force, modify, or disable target systems

Input control

Changes to workspace configuration, credentials, membership, exceptions, and platform settings are recorded in the audit log with the acting user and the time. Scan results retain the evidence they were derived from, so a finding can be traced back to its source.

Availability and resilience

• Automated database backups with documented rotation, and a documented and scripted restore procedure
• Schema migrations applied as part of the release process rather than by hand
• Readiness and health endpoints checked during deployment, so a release that does not come up cleanly fails
• Error and exception monitoring with personal data scrubbed from reports
• Documented recovery runbook for the production environment

Pseudonymization and data minimization

The service collects the inventory attributes needed for asset identification and risk assessment. Reports and exports can be limited to the fields the recipient needs. Retention periods for audit records and scan history are configurable per deployment.

Procedures for regular review

• Automated test suite and static checks run on every pull request and before a release
• Dependency and configuration review before each release
• Periodic review of roles, platform administrator accounts, and enrolled agents
• Incident handling covering detection, assessment, notification of affected controllers, and remediation

Placeholder notice

Confirm the hosting provider's certifications, the backup rotation period, the audit log retention setting, the review cadence, and the incident process actually in force, and record the responsible person for each measure, before this document is attached to a customer agreement.