Data Processing Agreement
Version 1.2, effective from 31 October 2026.
Parties
1. The organisation that uses oQuiz for business and whose administrator accepts this agreement in the service, or that signs it (the "Customer"), as controller; and
2. House of Buttons AB, company reg. no. 559607-0911, Nina Einhorns gata 7, 113 66 Stockholm, Sweden ("oQuiz"), as processor.
1. Background
1.1 The Customer uses oQuiz for business under the oQuiz Terms of Service at oquiz.app/tos, with licences per person and year (the "Main Agreement"). In providing the services under the Main Agreement, oQuiz processes personal data on the Customer's behalf.
1.2 This Data Processing Agreement (the "DPA") governs that processing under Article 28 of Regulation (EU) 2016/679 (the "GDPR"). If the DPA and the Main Agreement conflict on personal data, the DPA prevails.
1.3 The DPA is entered into when an administrator of the Customer's organisation accepts it in oQuiz, or when the parties sign it. oQuiz records who accepted it, when, and which version.
1.4 Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meaning given in the GDPR.
1.5 The DPA is available in English and Swedish. If the versions differ, the English version prevails.
2. Roles and scope
2.1 The Customer is the controller of the personal data processed within the Customer's organisation in oQuiz: the organisation's accounts, quizzes, slides, comments, games hosted by the organisation's hosts, saved games and reports, branding, training sessions and courses with their participants, answers and certificates, forms and self-assessments with their recipients and answers, connected sources and recipient lists, and AI generations requested from the organisation's accounts ("Customer Personal Data"). oQuiz processes Customer Personal Data as the Customer's processor.
2.2 oQuiz is an independent controller, and the DPA does not apply, for (a) product analytics that oQuiz collects with the user's own consent in the app, in the panel on join.oquiz.app or on oquiz.app, (b) billing, purchases, the customer relationship and contact with the Customer's contact persons, (c) security logs and abuse prevention to the extent oQuiz determines their purpose, (d) individuals' use of oQuiz outside the Customer's organisation, and (e) the aggregated and anonymised statistics described in Section 11.5 of the Main Agreement, including the anonymisation itself.
2.3 The subject matter, nature and purpose of the processing, and the types of personal data and categories of data subjects, are set out in Annex 1.
3. The Customer's instructions
3.1 oQuiz processes Customer Personal Data only on the Customer's documented instructions. The Main Agreement, the DPA and the choices the Customer's administrators and users make in the service (for example inviting, sharing, saving, deleting, sending a form, connecting a source or an integration, or asking the AI to write a quiz) are the Customer's complete instructions. Further instructions must be given in writing. The Customer also allows oQuiz to use Customer Personal Data for the aggregated statistics under Section 11.5 of the Main Agreement (Aggregated statistics), for which oQuiz is an independent controller (Section 2.2(e)).
3.2 oQuiz may process Customer Personal Data without instructions where Union or Swedish law requires it. oQuiz will then inform the Customer before the processing begins, unless the law prohibits it.
3.3 oQuiz will inform the Customer immediately if, in its opinion, an instruction infringes the GDPR or other data protection law.
3.4 oQuiz does not use Customer Personal Data for its own purposes other than the aggregated statistics in Section 2.2(e), does not sell it, does not use it for advertising, and does not train AI models on it or let sub-processors do so. The statistics use answers, results, times, question ids and decisions about AI suggestions, never the text of quizzes, free text or names. A figure that compares organisations is built from at least five organisations and one hundred answers, with at least ten from each. The Customer can opt out of comparison figures in the settings; the rest of the statistics are part of the service.
4. Confidentiality
4.1 oQuiz ensures that every person authorised to process Customer Personal Data has committed in writing to confidentiality or is under a statutory obligation of confidentiality.
4.2 oQuiz does not disclose Customer Personal Data to third parties except to sub-processors under Section 6, to services the Customer itself connects (Annex 2, last table), or where law or a decision of a public authority requires it. If an authority requests Customer Personal Data, oQuiz will first refer the authority to the Customer and notify the Customer, where permitted.
5. Security
5.1 oQuiz implements the technical and organisational measures required by Article 32 GDPR. The measures are set out in Annex 3.
5.2 oQuiz may change the measures as long as the level of protection is not reduced. Material changes are notified to the Customer.
6. Sub-processors
6.1 By this DPA the Customer gives oQuiz a general written authorisation to engage sub-processors. The sub-processors engaged when the DPA is entered into are listed in Annex 2. The current list is always Annex 2 at oquiz.app/dpa.
6.2 oQuiz notifies the Customer in writing, by email to the Customer's administrators and by an updated Annex 2 at oquiz.app/dpa, at least 30 days before engaging a new sub-processor or replacing an existing one.
6.3 The Customer may object to the change on reasonable grounds within 30 days of the notice. The parties will then seek a solution in good faith. If none is found, the Customer may terminate the affected part of the Main Agreement with effect from when the change takes effect, and receive a refund of fees prepaid for the period after that.
6.4 oQuiz enters into a written agreement with each sub-processor imposing obligations equivalent to those in the DPA. oQuiz remains liable to the Customer for the sub-processor's performance.
6.5 Services that the Customer itself connects to oQuiz (for example Slack, Microsoft 365, Atlassian, Google Workspace or a learning platform) are not oQuiz's sub-processors. The Customer has its own agreement with them, and oQuiz sends data to and fetches data from them only as the Customer chooses in the service.
7. Transfers to third countries
7.1 Customer Personal Data is stored in the EU (see Annexes 1 and 2). Some sub-processors are established in, or process data in, the United States, and traffic passes through Cloudflare's global network.
7.2 oQuiz transfers Customer Personal Data to a country outside the EU/EEA only where the transfer is covered by an adequacy decision under Article 45 GDPR, including the EU–US Data Privacy Framework for certified recipients, or by appropriate safeguards under Article 46, primarily the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), together with any supplementary measures needed.
7.3 On the Customer's request, oQuiz provides a copy of, or a reference to, the transfer mechanism that applies to each sub-processor.
8. Assistance
8.1 Data subject rights. Taking into account the nature of the processing, oQuiz assists the Customer in responding to requests from data subjects under Chapter III GDPR (access, rectification, erasure, restriction, portability and objection). Much of this the Customer does itself in the service: accounts, quizzes, participants, recipients and answers can be changed and deleted, and deleting an account removes the account's quizzes, saved games, AI records and branding. If a request reaches oQuiz directly, oQuiz forwards it to the Customer without undue delay and does not answer it itself unless the Customer has so instructed.
8.2 Articles 32–36. oQuiz assists the Customer in meeting its obligations on security, notification of personal data breaches, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to oQuiz.
8.3 Assistance beyond what the service offers, or beyond a reasonable extent, may be charged at oQuiz's hourly rate in force at the time, once the Customer has approved the cost in advance. Assistance needed because oQuiz has breached the DPA is never charged.
9. Personal data breaches
9.1 oQuiz notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, aiming to do so within 48 hours.
9.2 The notice describes, as far as the information is available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact person. Information not available at the first notice is provided as soon as it is.
9.3 oQuiz documents every breach and takes reasonable steps to contain it. The Customer decides whether to notify the supervisory authority and the data subjects.
10. Audits and information
10.1 oQuiz makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR.
10.2 The Customer may carry out, or have an independent auditor bound by confidentiality carry out, audits and inspections. The Customer gives oQuiz at least 30 days' notice, and audits take place during business hours, no more than once a year unless a breach, an authority or other specific reasons justify more. Each party bears its own costs.
10.3 oQuiz may meet the audit right primarily through written answers, Annex 3 and the sub-processors' own audit reports. oQuiz has no independent audit report of its own today.
11. Return and deletion
11.1 When the Main Agreement ends, that is, when the organisation's licences have ended without being renewed, the Customer may for 90 days take out its data with the exports in the service: quizzes as CSV, game reports as PDF and CSV, results of training sessions and courses as CSV, certificates as PDF and form answers as CSV. On request, oQuiz provides the organisation's data in a machine-readable format free of charge within 30 days. oQuiz then deletes Customer Personal Data, unless Union or Swedish law requires it to be kept. If the Customer deletes the organisation, oQuiz deletes Customer Personal Data at once.
11.2 During the term of the Main Agreement:
- a participant's name and email address are removed from all of the organisation's training sessions, courses and forms two years after the participant's last attempt, review or invitation; their certificates are deleted and their answers are kept without a name;
- answers to a public form are deleted after the number of days the Customer has chosen for that form (1–365, default 365), counted from when the answer was started.
11.3 Copies in sub-processors' backups are deleted on their schedules; the database's restore points in Cloudflare D1 (Time Travel) are kept for no more than 30 days. oQuiz confirms deletion in writing on request.
12. Liability
12.1 Each party is liable for damage as provided in Article 82 GDPR. A party that has paid compensation to a data subject may recover from the other party the share corresponding to that party's responsibility.
12.2 Otherwise, oQuiz's total liability under the DPA and the Main Agreement is limited to the fees the Customer paid for licences in the twelve months before the damage occurred. An administrative fine imposed on a party by a supervisory authority is borne by that party.
13. Term
The DPA applies for as long as oQuiz processes Customer Personal Data, and ends automatically afterwards. Sections 4, 11 and 12 survive termination.
14. Changes
14.1 oQuiz may amend the DPA when data protection law, the Commission's Standard Contractual Clauses or the service change. An amendment is notified to the Customer's administrators at least 30 days before it takes effect and published with a new version number at oquiz.app/dpa. An amendment may not reduce the protection of Customer Personal Data.
14.2 If the Customer does not accept the amendment, the Customer may terminate the Main Agreement with effect from the day the amendment takes effect, and receive a refund of fees prepaid for the period after that. Changes of sub-processors follow Section 6.
14.3 A signed agreement is amended only in writing by both parties.
15. Governing law and disputes
The DPA is governed by Swedish law. Disputes are settled by the general courts, with the Stockholm District Court (Stockholms tingsrätt) as the court of first instance.
Signatures (when the DPA is signed instead of accepted in the service)
| For the Customer | For House of Buttons AB |
|---|---|
| Organisation and reg. no.: | |
| Place and date: | Place and date: |
| Name: | Name: |
| Title: | Title: |
Annex 1: Description of the processing
| Subject matter | Provision of oQuiz for business: writing quizzes together, hosting games where participants answer on their own phones, presenting, saving games and reports, having the AI write quizzes, training sessions and courses with knowledge tests, forms and self-assessments, and connections to the Customer's own services. |
| Duration | The term of the Main Agreement and the period for return and deletion under Section 11. |
| Nature of the processing | Collection, storage, organisation, display, real-time transfer between participants' devices, re-encoding of images and audio, sending email, compiling reports, export, transfer to an AI service on request, making data available for the statistics in Section 2.2(e), and erasure. |
| Purpose | Providing the service under the Main Agreement, including sign-in, collaboration on quizzes, running games, training sessions and forms, sending messages, reports, quotas and abuse prevention. The aggregated statistics under Section 11.5 of the Main Agreement are oQuiz's own processing (Section 2.2(e)). |
Categories of data subjects
- The Customer's users with an account: hosts, trainers, quiz authors and administrators in the organisation.
- Participants in games hosted by the organisation's hosts (no account needed).
- Recipients of the Customer's training sessions, courses, forms and self-assessments, for example employees, and members of groups the Customer takes recipients from.
- People who answer the Customer's public forms, for example visitors to the Customer's website.
- People named or shown in quiz content (for example in photos, recordings, question text or text pasted for the AI).
Types of personal data
| Area | Data | Storage |
|---|---|---|
| Account | oQuiz's own id, the sign-in provider's account id (Apple, Google, Microsoft or the organisation's sign-in through SAML or OIDC), chosen name, chosen avatar and background, work domain, organisation membership, role and licence. For Microsoft accounts the id, name and username are read. Accounts created through SCIM have the username from the Customer's directory. The email address from Google and the username of a Microsoft work account are kept with the sign-in session, to tell the user when an AI quiz is ready, and removed when the session ends. Session tokens are stored only as SHA-256 hashes. | Cloudflare D1, EU |
| Quizzes and collaboration | Quiz content, questions and slides, memberships and roles, who wrote what, comments with their authors, presence (who is where in the builder, only while connected), text visible to others while it is typed, question reports (quiz id, question id, reporter's id). | D1, EU; real time in a Durable Object, EU |
| Media | Photos (re-encoded, metadata removed), audio recordings (rebuilt), logo and big-screen image, Apple Music catalogue ids, still image of a chosen GIF. | Cloudflare R2, EU |
| Games with connected phones | Team names, avatars, answers, map pins, scores; a hashed key for the host's device; a hashed form of the IP address (in memory only, for rate limiting). | Durable Object, EU; game link records in D1, EU, deleted within three days |
| Saved games and reports | Quiz name, date, team names, avatars, scores and placings, question text, correct answers and answer distributions, word-cloud words and poll votes (never which team), results page, preview image and PDF. At most 200 games per account. | D1 and R2, EU |
| Branding | Name, colour, logo, image, welcome and closing text, button with a link, short name, and the organisation's description of its industry and business. | D1 and R2, EU |
| Training sessions and courses | Recipients' names and email addresses, a hashed personal link, status of invitations and reminders, attempts with answers, scores and times, reviews, certificates with name and title, and links to the Customer's learning platform (LTI or SCORM). | D1, EU; certificates as PDF in R2, EU |
| Forms and self-assessments | Recipients' names and email addresses and a hashed personal link (personal sends), answers on scales, choices and free text (up to 2,000 characters), when the answer was started and submitted, a hash of a key in the respondent's browser (open links), and for public forms the hidden fields the Customer puts in the link. The self-assessment has scales only. Trainers see answers from personal sends only as totals for at least five people; free text from open links is never shown. In a public form oQuiz collects no name or email, but the Customer sees each answer. The Customer states in the form who handles the answers and a link to its privacy policy. The organisation's acceptance of the DPA is recorded with time, person and version. | D1, EU. The IP address is not stored; it is used for rate limiting and sent to Cloudflare Turnstile for public forms on oquiz.app. |
| Email from the service | The recipient's address and name, the subject and content of invitations, reminders, reviews and follow-ups, sent from training@oquiz.app with the Customer's reply-to address if the Customer has chosen one. | Sent with Cloudflare Email Service; a log of the sends in D1, EU |
| AI quizzes and AI text | Topic, language, whether for children, existing questions when asking for "more" or a swap, pasted text (up to 12,000 characters), the organisation's description, and text for training sessions and images. Pasted text is not stored by oQuiz. A record per generation: topic (empty for pasted text), language, time, number of questions and outcome. | Sent to Anthropic (US); the record in D1, EU |
| Knowledge-test sources | The address of a public web page or PDF that an organisation links to a knowledge test, its name, who linked it, and for each question the supporting quote, where it appears and a SHA-256 fingerprint per page or passage. The source text is fetched once a day, compared and not stored; when a quote no longer appears, the text is sent to Anthropic for a proposed change to the question. | Fetched by the server; the text to Anthropic (US) only on a change; the rest in D1, EU |
| Knowledge-test sources in SharePoint and OneDrive | The trainer's Microsoft account (display name and directory id), encrypted keys to Microsoft Graph with read access to the files the person can reach, and the file's or folder's id, name and address in SharePoint; supporting quotes and fingerprints as for a link. Only files the trainer has chosen are read, once a day when the content has changed, and they are not stored. The keys are removed when the person disconnects the account, leaves the organisation, or the administrator turns off the connection. | Fetched by the server from Microsoft; the text to Anthropic (US) only on a change or when the trainer asks for questions from a new file; the rest in D1, EU |
| Knowledge-test sources in Confluence | The trainer's Atlassian account (display name), the site's address and id, encrypted keys with read access to the pages the person can reach, and the page's id, name and address; supporting quotes and fingerprints as for a link. Only pages the trainer has chosen are read, once a day when the version has changed, and they are not stored. The keys are removed when the person disconnects the account, leaves the organisation, or the administrator turns off the connection. | Fetched by the server from Atlassian; the text to Anthropic (US) only on a change or when the trainer asks for questions from a new page; the rest in D1, EU |
| Knowledge-test sources in Notion | The trainer's Notion account (display name), the workspace's name and id, encrypted keys with read access to the pages the person has given the oQuiz Sources app in Notion, and the page's id, name and address; supporting quotes and fingerprints as for a link. Only pages the trainer has chosen are read, once a day when the page has changed and otherwise once a week, and they are not stored. The keys are revoked at Notion when the person disconnects the account, and removed when the person leaves the organisation or the administrator turns off the connection. | Fetched by the server from Notion; the text to Anthropic (US) only on a change or when the trainer asks for questions from a new page; the rest in D1, EU |
| Recipients from an Entra ID group | The group's id and name, and the members' names and email addresses, read through the trainer's Microsoft connection (as for sources). The members are saved as recipients, as a list; the group is read again every six hours and new members are added. A person who leaves the group stays until the organisation removes them. | Fetched by the server from Microsoft Graph; in D1, EU |
| Knowledge-test sources in Google Drive | The trainer's Google account (display name and email address), encrypted keys with read access only to the files the person chose in Google's file picker (drive.file), and the file's id, name and address; supporting quotes and fingerprints as for a link. The files are read once a day when they have changed and are not stored. The keys are revoked at Google when the person disconnects the account, and removed when the person leaves the organisation or the administrator turns off the connection. | Fetched by the server from Google; the text to Anthropic (US) only on a change or when the trainer adds the file; the rest in D1, EU |
| Recipients from a Google Workspace group | The group's id and name and the members' email addresses, read through the trainer's Google connection after the person has granted read access to groups. The trainer's email address is used to list the groups the person belongs to. The members are saved as recipients, as a list; the group is read again every six hours and new members are added. | Fetched by the server from Google Cloud Identity; in D1, EU |
| Slack | The Customer's workspace and an encrypted key to the oQuiz app in it, recipients' Slack ids (looked up by their email address), messages with personal links and totals, and for Quiz of the week the messages from the past week in the channels the Customer has chosen. The channels' messages are sent to Anthropic to write the quiz and are not stored. | Fetched and sent by the server; in D1, EU; the text to Anthropic (US) |
| The Customer's own domains | The domain name and the status of its certificate, when the Customer shows the participant pages on its own domain. | D1, EU; the certificate at Cloudflare |
| Purchases and licences | That the account or organisation has a purchase, pass or licence. | D1, EU |
No special categories of personal data (Article 9) or data relating to criminal convictions and offences (Article 10) are needed for the service. The Customer is responsible for ensuring that users do not enter such data in quizzes, comments, pasted text or the questions of a form, and that a form does not ask for it.
Public forms. The Customer is responsible for having a legal basis for the form, for informing the respondents (the form shows the party responsible and the link to the Customer's privacy policy), and for the hidden fields put in the link. Public mode requires an administrator to have accepted the DPA.
Retention in the service: for as long as the Customer keeps the data, subject to the shorter periods in the table and in Section 11.2, and at most as set out in Section 11.1.
Annex 2: Sub-processors
As of 28 October 2026.
| Sub-processor | Service and purpose | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| Cloudflare, Inc. (US) | Workers (the server), D1 (database), Durable Objects (real time for quizzes and games), R2 (images and audio), Browser Rendering (preview images and PDFs), Email Service (email from the service), Turnstile (bot protection for public forms), the Customer's own domains, rate limiting, Cloudflare Access (internal review tool), CDN and TLS | All types in Annex 1 except what goes only to Anthropic; IP address and technical data on every request | D1, R2 and Durable Objects with EU jurisdiction. Email and network traffic through Cloudflare's global network. | Cloudflare's DPA with Standard Contractual Clauses. Cloudflare, Inc. is certified under the EU–US Data Privacy Framework (active on dataprivacyframework.gov on 28 October 2026). https://www.cloudflare.com/cloudflare-customer-dpa/ |
| Google (Google Cloud EMEA Ltd, Ireland, and Google LLC, US) | Google Workspace: Gmail for support at hello@oquiz.app | What the Customer's users write to support, and data the Customer sends for help | Google's data centres, including outside the EU | Google's Cloud Data Processing Addendum with Standard Contractual Clauses. Google LLC is certified under the EU–US Data Privacy Framework (active on dataprivacyframework.gov on 28 October 2026). https://cloud.google.com/terms/data-processing-addendum |
| Anthropic Ireland, Limited (Ireland), with Anthropic, PBC (US) | Claude writes AI quizzes and text only when a user asks, proposes changed questions when a source has changed, and writes Quiz of the week from the Slack channels the Customer has chosen | Topic, language, audience, existing questions, pasted text, the organisation's description, source text on a change, the channels' messages | US | Anthropic's DPA, incorporated in its Commercial Terms, with Standard Contractual Clauses. Anthropic does not train on API data and deletes inputs and outputs within 30 days, except content flagged for misuse. https://www.anthropic.com/legal/commercial-terms |
Services that are not sub-processors (oQuiz does not give them Customer Personal Data on oQuiz's behalf), but which the Customer should know about:
| Service | Why it is not a sub-processor |
|---|---|
| Apple (Sign in with Apple), Google (Sign in with Google), Microsoft (sign-in with a work or personal Microsoft account), the Customer's own sign-in through SAML or OIDC | The user signs in directly with the provider, which is an independent controller for the sign-in. oQuiz receives the account id, the name and, for Google and Microsoft, the email address or username. |
| Klipy (Kikliko, Inc., US): search for GIFs, stickers, memes and clips | The user's app or browser searches and loads the images from Klipy with oQuiz's API key, so Klipy sees the device's IP address and the search term. When oQuiz's server fetches for a game, no personal data reaches Klipy. https://klipy.com/support/privacy-policy |
| Unsplash (US): photo search | The server searches Unsplash with the search term; the chosen photo is shown from Unsplash, which then sees the viewer's IP address. |
| Apple Music (MusicKit) | Playback happens on the user's device with the user's own subscription. oQuiz stores only catalogue ids. |
| ElevenLabs (US): voices | Reads only oQuiz's own question packs and the mascot's lines, never the Customer's quizzes. |
| PostHog, Inc. (EU cloud, US company) | Product analytics with each user's own consent, with oQuiz as independent controller (Section 2.2), in the app, in the panel on join.oquiz.app and on oquiz.app. The participant game pages have no PostHog. |
| Paddle | Sells licences on the web as merchant of record and is an independent controller for the purchase. |
Services the Customer itself connects (Section 6.5): Slack, Microsoft 365 (SharePoint, OneDrive, Entra ID, Teams), Atlassian Confluence, Notion, Google Workspace (Drive, groups, Chat) and the Customer's learning platform. oQuiz fetches and sends data there only when the Customer has connected the service, and the Customer can disconnect it.
Annex 3: Technical and organisational security measures
In place today
Encryption and network
- All traffic to join.oquiz.app and oquiz.app uses HTTPS with TLS terminated by Cloudflare. The session cookie
oq_sessionisHttpOnly,SecureandSameSite=Lax, and lasts 30 days. - Data in D1, R2 and Durable Objects is encrypted at rest by Cloudflare.
- Keys to the Customer's connected services (Microsoft, Atlassian, Google, Slack) are stored encrypted in the database.
Identity and access
- Sign-in only through Apple, Google, Microsoft or the Customer's own sign-in (SAML or OIDC), and accounts can be managed with SCIM. oQuiz has no passwords.
- Session tokens, device codes and personal links are stored only as SHA-256 hashes; an Apple identity token can be used once.
- The host's key to a game is stored only as a hash.
- The review tool (
/granska,/v1/review) is behind Cloudflare Access, and the server also verifies the Access token itself (RS256, correctaud). - Secrets (API keys, OAuth secrets) are kept as encrypted secrets in Cloudflare, never in the code.
- Permissions in quizzes and the organisation are role-based (owner, editor, administrator) and checked on the server, not in the client.
Data minimisation
- Photos are re-encoded and recordings rebuilt on the server, which removes embedded metadata such as location; sizes are limited.
- Text pasted for the AI and source text are not stored in the database or the log.
- IP addresses are not stored; rate limiting uses a hash, in memory only.
- Form answers from personal sends are shown only as totals for at least five people.
- Game link records are deleted within three days; game data one hour after the code expires (at most 48 hours). Participants' names in training sessions and forms are removed after two years, and public form answers after the period the Customer chose.
Abuse prevention
- Cloudflare rate limits for games, six-digit codes, purchases and forms, a daily cap on answers to public forms, and Cloudflare Turnstile for public forms on oquiz.app.
- An AI quota per account, a conditional reservation against concurrent requests, and a daily cost cap.
Development and operations
- Automated tests for the server (about 140 test files), the web (about 100) and the app. The forms' privacy tests run automatically before every release of the server; the other tests are run by hand before release.
- Every release is a Cloudflare version that can be rolled back; database migrations are versioned in git.
- No third-party scripts are loaded from other origins, except Cloudflare Turnstile in public forms; the web pages have a Content Security Policy.
Organisation
- One person (the founder) has access to production and has signed a confidentiality undertaking.
- Two-factor sign-in on the administrative accounts at Cloudflare, GitHub, Apple, Google and Anthropic.
Planned, not yet in place
- Written policies for information security, access, incident handling, change management, suppliers and continuity.
- Logging with retention and alerts for the server.
- Documented backups of R2 and restore tests.
- Automated vulnerability scanning of dependencies and code, continuous integration and an annual penetration test.
- A combined export of the organisation's data in the service.
- SOC 2 Type 1 followed by SOC 2 Type 2.