Annex A Security measures

Version 2026-09-22

These measures apply to Customer Personal Data. Their implementation may evolve under DPA Section 6.2 (Security schedule). They describe contractual controls, not a certification or a guarantee that incidents cannot occur.

A1 Governance and personnel

Sellforte assigns responsibility for information security and privacy, maintains relevant policies, reviews risks and controls regularly and after material changes, and trains personnel on their duties. Personnel are bound by confidentiality and receive access only as needed for their work.

A2 Access and separation

Access uses individual identities, least privilege, and prompt removal when no longer needed. Privileged and remote administrative access uses multifactor authentication. Customer environments and data are logically separated. Access permissions are reviewed periodically; production access and privileged changes are logged.

A3 Transmission and storage

Customer Personal Data is encrypted in transit over public networks using current secure protocols and encrypted at rest in production storage and backups. Encryption keys and credentials are restricted to authorized systems and personnel and managed separately from publicly accessible code. Secrets are protected and rotated when compromised or otherwise required by policy.

A4 Infrastructure and development

Hosting providers maintain physical and environmental protections for their facilities. Sellforte configures network restrictions, secure administrative access, malware defenses where appropriate, and protected deployment processes. Code and material changes are reviewed and tested before production release. Security vulnerabilities are assessed and remediated according to severity, exposure, and available mitigations.

A5 Logging and incident response

Sellforte logs security-relevant events, protects logs against unauthorized access and alteration, and investigates material alerts. Logs are proportionate and avoid unnecessary Customer Content. Documented response procedures cover assessment, containment, recovery, and notice under DPA Section 9 (Personal Data Breach). Security incidents and corrective actions are recorded.

A6 Availability and recovery

Sellforte maintains backups and recovery procedures appropriate to the Services and tests restoration periodically. Backups are protected against unauthorized access and ordinary production use. Retention and erasure follow ToS Section 17.6 (Return and erasure). This Annex does not establish a recovery-time or recovery-point guarantee; any agreed service levels are in the SLA.

A7 Data lifecycle and requests

Sellforte limits processing to agreed purposes, supports authorized correction, export, and erasure, and applies retention rules to active systems, backups, and supplier-held copies. Deletion covers Customer Personal Data in support attachments, logs, recordings, transcripts, summaries, and other derived records, subject only to applicable lawful retention exceptions. Erasure is reapplied following restoration before data returns to ordinary use. Shorter legal or source-provider deadlines override the maximum backup period. Production Personal Data is not used in development or testing unless necessary, authorized, and protected by equivalent controls; anonymous or synthetic data is preferred.

A8 Suppliers and transfers

Suppliers are assessed before receiving Customer Personal Data and are subject to written processing and security obligations, location controls, and lawful transfer mechanisms. Material changes follow DPA Sections 7 (Subprocessing) and 13 (International transfers). Sellforte maintains information necessary to demonstrate compliance and facilitates audits under Section 12 (Audit rights).

A9 AI and integrations

Access to AI features, connectors, Tracking Technology, and external tools is scoped to authorized data and functions. Credentials are protected, external instructions do not override access permissions, and Automated Actions require the authorization in ToS Section 2.3 (Automated Actions and external tools). Customer Personal Data is excluded from general-purpose model training. Supplier abuse-monitoring retention, where applicable, remains subject to the DPA and disclosed processing configuration.

Back to document navigation