Updated 16 September 2026
Technical and Organisational Measures
This English version is provided for convenience. The Romanian version at /ro/informatii-legale/masuri-tehnice-organizatorice/ is the binding text.
This page is Annex 3 to the Data Processing Agreement. It describes the measures Amazing Soft applies to protect the personal data it processes on behalf of clients, in accordance with Article 32 GDPR. The measures are proportionate to the activity of a software company and to the risks of the processing described in Annex 1 of the Agreement. Amazing Soft does not currently hold certifications such as ISO/IEC 27001 and makes no such claim.
1. Governance and responsibilities
1.1. Amazing Soft’s management (the shareholders) is responsible for the security and data protection policy. The data protection contact is available at gdpr@amazingsoft.ro.
1.2. The measures below are reviewed at least once a year and after any significant security incident.
1.3. Amazing Soft keeps a record of processing activities (Article 30 GDPR) both for its own processing and for the processing carried out on behalf of clients.
2. Access control
2.1. Two-factor authentication (2FA) is mandatory on all accounts that give access to client data or to infrastructure: e-mail, GitLab, Hetzner, Romarg, Cloudflare, provider accounts (App Store Connect, Google Play Console, Google Cloud/Firebase, MongoDB Atlas, AI model providers), WordPress admin panels.
2.2. Least-privilege principle: each person receives only the access needed for the task. Access to clients’ production systems is granted on named (not shared) accounts, where the client’s system allows it, and is limited to the period of the intervention.
2.3. Revocation: at the end of a project or when a contractor leaves, access is revoked within no more than 2 working days of the end of the project or of the contractor’s departure, and passwords shared with that person are rotated.
2.4. Passwords: unique per service, complex and never reused; never sent by e-mail or chat and never written into source code.
2.5. Client accounts: credentials received from clients are kept separately per client, are never sent by e-mail or chat, and are deleted at the end of the project.
3. Encryption
3.1. In transit: all exposed services use TLS 1.2 or later (HTTPS, SSH, SFTP/FTPS). No transmission of client data over unencrypted channels.
3.2. At rest: work devices (laptops, phones) have full-disk encryption enabled (FileVault, BitLocker or equivalent) and automatic locking.
3.3. Physical security of servers lies with the infrastructure providers: Amazing Soft’s servers are at Hetzner, in audited (TÜV) data centres; for websites hosted at Romarg, the hosting provider’s measures apply.
3.4. Secrets: API keys, tokens and certificates are kept in environment variables or in a secrets manager, never in code repositories. Keys are rotated on suspicion of compromise and at the end of the project.
4. Separate environments and production data
4.1. Development, testing (staging) and production are separate environments, with different credentials.
4.2. Production data is not copied into development or test environments except after anonymisation or pseudonymisation, or on the client’s written instruction for a specific case (for example, reproducing a bug), in which case the copy is deleted once the issue is resolved.
4.3. Test data sets are generated synthetically whenever possible.
4.4. For AI agents, clients’ real conversations are not used for testing without the client’s instruction; tests use constructed scenarios.
5. Backups
5.1. The amazingsoft.ro website (WordPress) has automatic daily backups of its files and database, through UpdraftPlus. The last 14 file backups and the last 30 database backups are kept, stored separately from the production server, in Google Drive (Google Workspace).
5.2. For the other systems administered by Amazing Soft, backup frequency is set per system. Backups expire in the rotation cycle, no later than 90 days after the data is deleted from active systems (Article 13.2 of the Agreement).
5.3. For clients’ systems, responsibility for backups is set out in the contract; in the absence of a provision, backups remain the client’s responsibility.
6. Logging and monitoring
6.1. Access to servers and panels administered by Amazing Soft is logged (logins, administrative actions).
6.2. Managed WordPress websites have a web application firewall, file scanning and alerts on repeated failed logins.
6.3. Code changes go through Git repositories with full history; deployment to production follows documented procedures, not direct editing on the server, except for emergency interventions documented afterwards.
6.4. Service availability is monitored with tools hosted by Amazing Soft (Uptime Kuma). If a project uses external error reporting, it is listed as a Sub-processor, and the default configuration excludes personal data from reports, as far as possible.
7. Devices and workplace
7.1. Work is carried out only on devices administered by Amazing Soft or explicitly approved, with encryption, automatic updates, anti-malware protection and locking on inactivity.
7.2. No storage of client data on unencrypted removable media. Project documents are kept in cloud workspaces with controlled access, not on personal devices.
7.3. Work from public spaces is done with screens shielded and on trusted connections (VPN or mobile network), not on unprotected public Wi-Fi.
8. Contractors and subcontracting
8.1. All contractors (employees, sole traders, freelancers, partners) sign a non-disclosure agreement (NDA) and an undertaking to comply with these measures before being given access to data.
8.2. Contractors receive basic data protection training at the start of the engagement and an annual refresher.
8.3. Subcontracting part of the services to a third party that would process client data is done only in accordance with Article 9 of the Agreement (prior notice, right to object).
9. Providers (Sub-processors)
9.1. Before using a new provider for client data, Amazing Soft checks: the existence of a data processing agreement, the data location, the transfer mechanism for transfers outside the EEA, the published security measures and, for AI model providers, the no-training commitment and the retention options.
9.2. The list of providers is published on the Sub-processors page and is reviewed on every change and at least annually.
10. Incident response
10.1. Amazing Soft has a written incident response plan with four steps: detection and containment; assessment (which data, how many persons, what risk); notification (the client, without undue delay and no later than 48 hours after Amazing Soft became aware of the breach, in accordance with Article 33(2) GDPR and Article 12.2 of the Agreement; the authority, where Amazing Soft is the Controller, within no more than 72 hours, in accordance with Article 33(1) GDPR); remediation and lessons learned. Client support hours are Monday to Friday, 10:00–18:00, Romanian time; breach notification does not depend on these hours.
10.2. Every incident is recorded in an internal register, even if it did not require notification.
10.3. Incident contact: gdpr@amazingsoft.ro.
11. Secure development and testing
11.1. Code is reviewed before integration (merge request) and goes through automated tests where they exist.
11.2. Dependencies are updated periodically; known vulnerabilities are addressed with priority according to severity.
11.3. Applications and websites follow common security practices (input validation, protection against injection and CSRF, session management, rate limiting). Specialised security testing (penetration testing) is carried out at the client’s request or when the risk requires it.
11.4. Data protection by design (Article 25 GDPR): the default settings of delivered solutions minimise the data collected and the retention periods.
12. Deletion and return
12.1. At the end of a project, the client’s data is returned or deleted in accordance with Article 13 of the Agreement; deletion covers working repositories, password vaults, project spaces and, in the rotation cycle, backups.
12.2. Decommissioned devices are securely wiped or physically destroyed.
13. Business continuity
13.1. Project source code and documentation are kept in Amazing Soft’s GitLab instance (Hetzner), not on individual devices, so that a project can be resumed after the loss of a device.
13.2. At least two members of management have emergency access to the essential administration accounts, with documented recovery procedures, so that the unavailability of a single person does not block access.
The measures may be updated in accordance with Article 8.2 of the Agreement, without lowering the level of protection. Previous versions are available on request.