Technical and Organizational Measures (TOMs)
Optizio Ltd has implemented the following Technical and Organizational Measures (TOMs) to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services, in accordance with Article 32 of the GDPR.
1. Measures to Ensure Confidentiality (Art. 32 para. 1 lit. b GDPR)
1.1 Physical Access Control
- Optizio relies on top-tier cloud service providers (Cloudflare) which employ strict physical security controls at their data centers (e.g., 24/7 security, biometric access, CCTV). Optizio employees do not have physical access to the servers.
1.2 Logical Access Control
- Authentication: Multi-Factor Authentication (MFA) is strictly enforced for all critical systems and administrative access.
- Password Policy: Enforced use of strong, unique passwords (minimum 12 characters) managed via a secure password manager. Passwords are checked against known breached databases.
- Authorization: Role-Based Access Control (RBAC) is implemented, following the principle of least privilege. Access rights are reviewed quarterly and revoked immediately upon employee departure.
1.3 Data Access Control
- Encryption at Rest: All sensitive data stored within Optizio’s databases (e.g., Cloudflare D1) and backups are encrypted using industry-standard encryption (AES-256).
2. Measures to Ensure Integrity (Art. 32 para. 1 lit. b GDPR)
2.1 Data Transfer Control
- Encryption in Transit: All network traffic and data transfers between users, the app, and Shopify APIs are encrypted using TLS 1.2 or higher.
2.2 Input Control
- Logging and Monitoring: Systems are configured to log and monitor access and operational events, and application errors are captured via a dedicated error-monitoring service (Sentry). This ensures traceability of who accessed, modified, or removed data.
- Secure Development: Strict Secure Software Development Lifecycle (SDLC) is followed. Automated tools for static and dynamic code analysis, vulnerability scanning, and dependency checks are integrated into CI/CD pipelines.
3. Measures to Ensure Availability and Resilience (Art. 32 para. 1 lit. b and c GDPR)
3.1 Backup and Recovery
- Automated Backups: Data stored in Cloudflare D1 supports point-in-time recovery to any minute within the last 30 days. Critical Shopify Metafield data is versioned in Cloudflare KV.
- Retention: Backups are retained for 30 days and are securely deleted thereafter.
- Testing: Periodic tests are conducted to verify the integrity and recoverability of backups.
3.2 Incident Management
- Incident Response Plan: A documented Incident Response Plan is in place, defining roles (e.g., Incident Response Lead) and procedures for identification, containment, eradication, and recovery from security incidents.
- Breach Notification: Optizio commits to notifying affected controllers without undue delay (and regulatory bodies within 72 hours where applicable) after becoming aware of a personal data breach.
4. Procedures for Regular Testing, Assessment, and Evaluation (Art. 32 para. 1 lit. d GDPR)
4.1 Audits and Reviews
- Internal Audits: Regular internal audits are conducted to ensure compliance with internal policies and legal requirements.
- Penetration Testing: Penetration testing is conducted for major releases or significant architectural changes.
- Policy Reviews: The Information Security Policy, SDLC Policy, Incident Response Plan, and Backup Policy are reviewed at least annually or following significant changes.
4.2 Training and Awareness
- All employees and contractors undergo regular training on information security, data protection (GDPR), and incident reporting to ensure awareness of their responsibilities.