Security controls
Our active security and privacy controls. Each item is described in more detail in the Security & Data Protection Overview.
Access and identity
Multi-factor authentication Active
Required on every company system. Read morePersonal accounts Active
Everyone has their own accounts, and no one shares an account. Read moreLeast-privilege production access Active
Only designated engineers reach production, with only the rights they need. Read moreAccess reviews Active
Twice a year, and whenever someone joins or leaves. Read moreEncrypted remote access Active
Engineers reach production over SSH, authenticated with keys. Read moreThird-party access controlled Active
Third parties get access only when needed, for as long as needed, and it's monitored. Read morePasswordless sign-in Active
Customers sign in with one-time email codes or single sign-on, and API clients with their own OAuth 2.0 credentials. Read moreCredentials in password managers Active
Shared keys and credentials are kept nowhere else. Read moreDefault credentials changed Active
Vendor-supplied passwords are changed before a system goes into use. Read moreInfrastructure and network
Hosted in the EU Active
Our systems and production database run in Frankfurt, Germany. Read moreEncryption in transit Active
TLS 1.2 or higher for all traffic, including to our providers. Read moreEncryption at rest Active
For the production database, backups and logs. Read moreFirewall and DDoS protection Active
Cloudflare's firewall and DDoS mitigation sit in front of all our services. Read moreNetwork segregation Active
Our frontends, gateway and internal API are kept apart, down to the network. Read moreSeparate environments Active
Production, staging and test are fully isolated. Read moreNo production data in test Active
Staging and test environments never hold production data. Read moreCapacity monitoring Active
We watch resource usage and add capacity before it runs short. Read moreLogging and monitoring
Central logging Active
Logs are kept with Better Stack, apart from the systems that produce them. Read moreLogs kept for a year Active
Logging data is retained for 12 months. Read moreSynchronized clocks Active
Timestamps line up across our systems and logs. Read moreAlerts and log reviews Active
Our systems raise alerts, and we review logs and alerts as a routine. Read moreAI access to bookings logged Active
Every booking record an AI assistant reads for a member of staff is logged under their name. Read moreDevelopment
Every change reviewed Active
Someone other than the author reviews each code change before it is merged. Read moreProtected code Active
Branch protection and signed commits on GitHub. Read moreSecrets scanning Active
Keeps credentials out of our code. Read moreDependency patching Active
Monitored continuously, patched automatically, and reviewed every two weeks. Read morePenetration testing Active
An independent firm tests our services every year, starting in 2026. Read moreVulnerability reports Active
Reported to security@allaboard.eu and acknowledged promptly. Read moreIncidents and continuity
Incident response Active
Detection, assessment, containment, remediation and a review afterwards. Read moreBreach notification Active
To the Swedish Authority for Privacy Protection within 72 hours where required, and to affected customers without undue delay. Read moreDaily backups Active
Encrypted, and stored in the EU. Read moreRestore tests Active
We restore from backups twice a year. Read morePeople and devices
Confidentiality agreements Active
Every employee signs an NDA. Read moreSecurity awareness training Active
Every employee receives it. Read moreEncrypted devices Active
Full-disk encryption on every work device. Read moreMalware protection Active
On every work device, kept up to date. Read moreDevices returned and wiped Active
Collected when someone leaves, and wiped before reuse or disposal. Read moreWork from the EU Active
Remote work happens only within the EU/EEA. Read moreGovernance
Yearly policy review Active
Our security policies and the Security & Data Protection Overview, at least once a year. Read moreData processing agreement Active
Part of our Services Agreement, with nothing extra to sign. Read moreSub-processors managed Active
Every provider with access to personal data is listed, and agents hear of a new one 30 days ahead. Read moreCyber insurance Active
With Länsförsäkringar Stockholm. Read moreData and privacy
Only the data needed Active
Details like dates of birth only when a fare, a pass or a carrier needs them. Read moreRetention limits Active
Dates of birth, ID and discount card numbers and assistance needs are deleted 12 months after the journey, and accounting records after seven years. Read moreDeletion when customers leave Active
Deleted or anonymized within 90 days when a business customer leaves, apart from records the law requires us to keep. Read moreData subject requests Active
Access, rectification and erasure, handled without undue delay. Read moreNo card data Active
Card details go straight to Stripe and never reach our systems. Read moreNo AI training on your data Active
Customer and passenger data is never used to train AI models. Read more