Security

Security Overview

DPOSaaS applies a layered security model across its application, infrastructure and organisational operations.

The DPOSaaS application is built using managed Google Cloud and Firebase services, including Firebase Hosting, Cloud Firestore and Firebase Authentication. These services provide part of the underlying infrastructure security, while DPOSaaS remains responsible for application configuration, user permissions, access rules, secure development practices and operational governance.

Specialised functions are delegated to established service providers where appropriate. Stripe is used for payment processing, and Postmark is used for transactional email delivery.

Security therefore operates through a shared-responsibility model: infrastructure providers protect the services they operate, while DPOSaaS protects the application, its configuration, access model, workflows and use of customer information.

Encryption

DPOSaaS uses encryption to protect information during transmission and while it is stored within the managed cloud infrastructure supporting the platform.

Encryption in transit

Connections to the DPOSaaS platform are protected using HTTPS and Transport Layer Security. Firebase Hosting provisions SSL certificates for connected domains and serves hosted content through secure connections.

Communications between users, the application and managed backend services are transmitted through encrypted channels intended to protect information against interception or alteration while in transit.

Encryption at rest

Customer data stored in Cloud Firestore benefits from server-side encryption provided by Google Cloud. Cloud Firestore automatically encrypts data before it is written to disk.

Google Cloud applies encryption at the storage layer using the Advanced Encryption Standard, including AES-256 for stored data within its default encryption architecture.

Encryption key management

Encryption keys used by the managed Google Cloud infrastructure are handled through Google Cloud’s key-management architecture and access controls.

DPOSaaS does not publish cryptographic keys, credentials, secrets or internal key-management configurations.

Credentials and secrets

Authentication credentials, API credentials and platform secrets must not be exposed in public application code or public documentation.

Access to operational credentials is limited to authorised use and managed separately from ordinary customer-facing application functions.

Identity and Authentication

Access to DPOSaaS is protected through managed identity services and application-level access controls.

Firebase Authentication

DPOSaaS uses Firebase Authentication to support user identity and authentication processes.

Firebase Authentication provides managed mechanisms for creating and authenticating user accounts, handling sign-in processes and supporting password-reset workflows.

DPOSaaS remains responsible for configuring the authentication experience, assigning application permissions and controlling what authenticated users may access inside the platform.

Multi-factor authentication

The authentication architecture supports the use of multi-factor authentication where it is enabled and applicable to the relevant account configuration.

Session security

Authenticated access is handled through managed authentication tokens and application session controls.

The platform validates authenticated identity before providing access to protected application functions. Session and authentication data must not be exposed through public logs, URLs or client-visible configuration beyond what is required for the normal operation of Firebase services.

Authorisation and Access Control

Authentication establishes a user’s identity. Authorisation determines which information and platform functions that user is permitted to access.

Role-based access control

DPOSaaS applies role-based access controls within the application to restrict functions and information according to the user’s assigned responsibilities.

Permissions are designed to prevent ordinary users from accessing administrative or restricted functions that are not relevant to their role.

Firestore access controls

Access to information stored in Cloud Firestore is controlled through application logic, authenticated identity and Firestore security mechanisms.

Firebase Authentication and Cloud Firestore Security Rules can be used together to evaluate whether a user is authorised to read or modify protected information.

Least privilege

Access should be limited to the level required for the relevant user, administrative function or operational responsibility.

Administrative access is separated from ordinary customer use and should only be available to authorised personnel or authorised technical processes.

Cloud and Infrastructure Security

DPOSaaS is built using managed Google Cloud and Firebase services. This allows the platform to rely on established infrastructure controls while DPOSaaS focuses on application security, configuration, access governance and service operation.

Firebase Hosting

Firebase Hosting is used to deliver the web application through managed hosting infrastructure.

Firebase automatically provisions SSL certificates for connected domains so that hosted content can be delivered through secure HTTPS connections.

Cloud Firestore

Cloud Firestore is used as a managed cloud database for application information.

Cloud Firestore provides server-side encryption at rest and supports access protection through Firebase Authentication, Firestore Security Rules and Google Cloud identity and access mechanisms, depending on the way the service is accessed.

Managed infrastructure

Physical data-centre protection, underlying hardware maintenance, infrastructure redundancy and core cloud service operations are provided by Google Cloud as part of the managed infrastructure.

DPOSaaS does not operate its own physical data centres.

Network and Perimeter Protection

Network and perimeter protections are partly provided through the managed Google Cloud and Firebase infrastructure used by DPOSaaS.

The platform is delivered through managed HTTPS endpoints rather than through customer access to internal servers or databases.

DPOSaaS does not publicly disclose internal network configurations, firewall rules, service topology or infrastructure security policies.

Application Security

Application security is managed by DPOSaaS and complements the infrastructure controls supplied by the underlying cloud providers.

Security by design

Security and access requirements are considered when platform functions, data structures, permissions and workflows are designed or modified.

Features that process customer information should be assessed for appropriate access restrictions, data exposure risks and operational traceability before release.

Controlled development and deployment

Changes to the platform are developed and deployed through controlled development workflows.

The objective is to reduce unauthorised changes, configuration errors and unintended exposure of customer information.

Code and configuration review

Application changes should be reviewed in proportion to their security and operational impact.

Special attention should be given to authentication, authorisation, Firestore access, customer separation, administrative functions, external integrations and processing of sensitive governance information.

Dependency management

DPOSaaS relies on software libraries, managed services and external integrations.

Dependencies and integrations should be maintained and updated in order to address compatibility, reliability and known security concerns.

Environment separation

Development and production activities should be controlled to reduce the risk of unauthorised changes or accidental exposure.

Logging, Traceability and Monitoring

DPOSaaS uses operational records and platform traceability to support service oversight, troubleshooting, governance and investigation.

Application traceability

The platform includes governance and operational records intended to support accountability and reconstruction of relevant actions.

Depending on the module and user permissions, this can include decision records, governance actions, evidence records and operational history.

Operational monitoring

DPOSaaS monitors relevant application and service conditions to support availability, diagnostics and incident detection.

Monitoring is proportionate to the services operated by DPOSaaS and the capabilities provided by its managed service providers.

Data Resilience and Recovery

DPOSaaS uses managed cloud services designed to support infrastructure resilience and service continuity.

Recovery and continuity measures are considered according to the services operated, the information processed and the capabilities available through the underlying infrastructure.

Operational recovery procedures are maintained without publishing internal recovery instructions or security-sensitive configurations.

Payment Security

DPOSaaS uses Stripe to provide payment-processing services.

Payment information entered through Stripe-hosted or Stripe-provided payment components is processed through Stripe’s payment infrastructure. DPOSaaS does not use its application database as a repository for complete payment-card details.

Stripe maintains its own security and compliance programme for the payment services it operates. Information about Stripe’s certifications and payment-security controls should be obtained from Stripe’s official security and compliance documentation.

Transactional Email Security

DPOSaaS uses Postmark for transactional email delivery.

Transactional messages may include operational notifications, authentication-related communications and service messages generated by the platform.

Postmark supports verified sending domains and email-authentication mechanisms such as DKIM. Email authentication helps receiving systems verify the origin of messages and detect certain forms of impersonation or message alteration.

DPOSaaS is responsible for the correct configuration and authorised use of its sending domains, message templates and Postmark integration.

Incident Response

DPOSaaS maintains an internal process for identifying, assessing and responding to security and privacy incidents.

The response process is intended to support:

• →Initial detection and reporting
• →Assessment of affected systems and information
• →Containment of identified risks
• →Investigation and evidence preservation
• →Remediation and service recovery
• →Evaluation of legal, contractual and regulatory obligations
• →Communication with affected customers or relevant parties where appropriate
• →Review of causes and corrective actions following the incident

Incident response activities are handled according to the nature, severity and potential impact of the event.

Vulnerability Management

DPOSaaS evaluates reported and identified security issues according to their potential impact on customer information, application integrity and service operation.

Confirmed vulnerabilities are assessed, prioritised and addressed in proportion to their severity, exploitability and operational risk.

Security improvements may include application changes, configuration updates, dependency updates, access-control corrections or coordination with an affected service provider.

Privacy and Data Protection

Security and privacy are related but distinct responsibilities within DPOSaaS.

Security controls are intended to protect the confidentiality, integrity and availability of information. Privacy governance addresses how personal data is collected, used, accessed, retained and otherwise processed.

As a privacy-governance platform, DPOSaaS incorporates concepts such as accountability, traceability, controlled access, evidence management and documented decision-making into its application workflows.

DPOSaaS processes customer information for the delivery, administration, protection and improvement of its contracted services, subject to the applicable contractual and privacy terms.

Customer information is not treated as DPOSaaS property merely because it is processed through the platform.

Shared Security Responsibilities

The security of a cloud service depends on coordinated responsibilities.

DPOSaaS is responsible for protecting the application functions it operates, configuring access controls, managing its production integrations and maintaining appropriate operational procedures.

Google Cloud and Firebase are responsible for the security of the managed infrastructure and services they provide, according to their respective service terms and security documentation.

Stripe is responsible for the payment-processing infrastructure it provides.

Postmark is responsible for the transactional email infrastructure it provides.

Customers are responsible for:

• →Protecting their account credentials
• →Assigning access only to authorised users
• →Selecting appropriate user roles
• →Removing access when it is no longer required
• →Using available authentication protections
• →Reviewing activity and governance records relevant to their organisation
• →Ensuring that information entered into the platform is processed lawfully
• →Notifying DPOSaaS of suspected account compromise or unauthorised activity

The use of established providers contributes to the DPOSaaS security architecture, but a provider’s certification does not automatically certify DPOSaaS itself.

Independent Assurance

DPOSaaS relies on managed service providers that maintain their own security, compliance and independent-assurance programmes.

Customers and reviewers should consult the official compliance documentation of Google Cloud, Firebase, Stripe and Postmark for authoritative information regarding certifications or audit reports applicable to the services they operate.

Provider certifications form part of the broader supply-chain assurance considered by DPOSaaS. They must not be presented as certifications directly awarded to DPOSaaS.

Our core infrastructure and specialised services are provided by established technology providers that maintain their own independent security and compliance programmes. Provider assurance is evaluated as part of DPOSaaS supplier governance, but does not replace DPOSaaS’s responsibility for the security of its own application and operations.

Technical Controls

A restrained summary of the verified technical controls described above.

Responsible Vulnerability Disclosure

DPOSaaS welcomes responsible reports from security researchers and other individuals who identify a potential vulnerability affecting the platform.

Reports should include sufficient information to help us understand and reproduce the issue, while avoiding unnecessary access to customer information, service disruption, social engineering or destructive testing.

Potential vulnerabilities should be reported through the process described in our Responsible Vulnerability Disclosure policy.

Security Contact

For security-related questions, suspected vulnerabilities or responsible disclosure reports, contact: