Security and Data Protection

1. 1

   Draft. Not reviewed by a security professional or counsel. This page lists only controls that exist in the software today, what we do not claim, and how the assistant and the match engine behave.

2. 2

   In place: Two roles, client and administrator. Administrator pages and data are checked on the server, not only hidden in the interface.

3. 3

   In place: Passwords are stored as argon2id hashes. Sessions are revoked when a password is changed or reset.

4. 4

   In place: Uploaded documents sit in private server storage that is never served statically. Each download goes through a signed-in route that checks who is asking.

5. 5

   In place: Password reset uses single-use tokens and rate limiting.

6. 6

   In place: Every download of an uploaded file is recorded with who opened it and when, and administrators can review that log.

7. 7

   In place: New uploads are encrypted at rest (AES-256-GCM) when the storage key is configured on the server. Files uploaded before it was switched on stay unencrypted until they are uploaded again.

8. 8

   In place: Retention: demo accounts are deleted after seven days; account and business records are kept while the account is open and removed within 30 days of a confirmed deletion request; accounting records such as invoices may be kept for up to seven years where the law requires it. Deletion is carried out by a person on request until it is automated.

9. 9

   In place: Clients can download their data as a file and request account deletion. A person handles the request, and records we must keep by law, such as invoices, may be retained.

10. 10

    Not claimed: No ISO 27001 or SOC 2 certification.

11. 11

    Not claimed: Encryption at rest depends on the storage key being set. Without it, files are stored with owner-only file permissions only.

12. 12

    Not claimed: There is no automatic deletion job yet, and no keys are held in a managed key service.

13. 13

    Responsible AI: The assistant is a scripted FAQ matcher. It does not call a language model.

14. 14

    Responsible AI: Questions about guarantees, tax avoidance or visas get a refusal and a pointer to the team. No ticket is opened automatically.

15. 15

    Responsible AI: The match engine is deterministic: the same answers always give the same result, and every point has a stated reason.

16. 16

    Professional-service boundary: Euronexis is software and coordination. It is not a law firm, accountancy, bank or immigration adviser. Regulated work is done by qualified professionals engaged for the purpose.

17. 17

    Incident contact: contact@euronexis.tech. Report a suspected security issue or data incident there; reports are read by the CTO, who triages them and tells affected users without undue delay.

Questions about this document can be sent to contact@euronexis.tech.