Technical and Organisational Measures

This document describes the technical and organisational measures by which the operator Ing. Matěj Kmínek, Company ID 02877961, secures personal data in the Attendees attendance system and on the attendees.eu website under Article 32 of the General Data Protection Regulation (GDPR). It is Annex 2 to the Data Processing Agreement.

The measures are appropriate to the nature of the data processed (attendance records, contact data, journeys), to the risk to customers' employees and to the size of the operation. The operator reviews them regularly, at least once a year and after every significant change to the system.

Separation of customers#

• Each customer has its own database and its own database user, which has permissions to that database only. One customer's system cannot read another customer's data.
• Each system has its own directory on the server with its configuration, logs, temporary files, sessions and images. The database access credentials are in a configuration file readable only by the web server account.
• A new system receives, at installation, its own randomly generated database password and its own API key.

Access control#

• Only the operator has access to the server. The server is shared with the operator's other applications; the account under which Attendees runs accepts key-based SSH authentication only (no password), and the administrative account is protected by a strong password and a limit on login attempts.
• Users of the system log in with a username and password. The customer's administrator assigns roles (administrator, superior, employee) and sets whether a superior sees only their own subordinates.
• The operator does not enter a customer's system unless this is necessary for support at the customer's request, for resolving an incident or for maintenance.

Encryption in transit#

• The website and all systems are available exclusively over HTTPS (TLS).
• The website sends security headers, including a Content Security Policy, which prevents the injection of third-party scripts.
• E-mails are sent by the operator's own mail server (mail.kminet.eu); no third party has access to them.

Passwords#

• User passwords are stored exclusively as a hash using the argon2id algorithm; they are neither stored in readable form nor shown to the operator.
• The first administrator's password is shown only once, on the installation page, after installation and is not sent by e-mail; the installation request is then deleted.
• Password reset links are stored only as a hash and have limited validity.

Backup and recovery#

• The databases and files of the systems are backed up daily; backups are retained for 30 days.
• Backups are stored on a separate server of the operator in the Czech Republic, apart from the server on which the systems run; only the operator has access to them.
• Restoring from backup is tested quarterly with a restore test.

Activity logs#

• The system records changes to attendance and settings (who changed what and when) in a history that the customer's administrator can see.
• The web server logs access; the application writes error reports (logs of the Tracy tool), which are retained for 30 days. Installer error reports are written as text without call parameters, so that they do not contain access credentials.
• The website's forms are protected against abuse: a limit on the number of submissions from one IP address and for one e-mail address, Cloudflare Turnstile verification and a hidden field against bots.

Updates#

• The operating system, PHP and the database server are updated regularly, and security fixes are applied without undue delay.
• New versions of the Attendees system are tested with automated tests and static code analysis before deployment.
• The application's dependencies are pinned in a version lock file and are updated in a controlled manner.

Incident handling#

• The procedure for a personal data breach is described in the Personal Data Breach Procedure: detection, assessment, containment, notification of customers without undue delay, and documentation.
• A failed system installation cleans up only what it created itself, and the reason for the failure is written to the log.

Personnel measures#

• The operator does business alone, without employees. Nobody else has access to customers' data.
• The operator is bound by confidentiality under the Data Processing Agreement. Should the operator engage another person in future, it will bind that person to confidentiality and grant them only the permissions that are strictly necessary.

Physical security#

• The server is located in the data centre of a hosting provider in the Czech Republic (SecurityNet.cz s.r.o. (brand Hukot), U Velorexu 1301, 564 01 Žamberk, Czech Republic, company ID 27501418). Physical access, power, cooling and fire protection are provided by the hosting provider.
• The operator has no physical access to the server; it manages it exclusively remotely.