Security at ELECTE
A technical overview for the people who have to sign off on us.
Last updated 22 August 2026.
Why this document is short
Most vendor security papers are long because length reads as diligence. This one is short because everything in it is a statement someone can check, and a statement nobody can check does not belong in it.
Three things are said plainly here that a longer paper would bury: which controls we inherit rather than operate, which control we do not have, and where our compliance evidence actually stands today.
The shape of the estate
ELECTE runs one application, self-hosted, in the European Union.
Application and database — Nuremberg, Germany
Off-site backups — Milan, Italy
Edge and DDoS protection — Global edge network, EU origin
Under normal operation customer data does not leave the EU. Data residency is not a consequence of where we happened to buy hosting — it is the control the rest of this document rests on.
What we run ourselves rather than sending to a vendor: analytics, site search, workflow automation for residency-sensitive data, our structured operational data, and identity. No third party receives that data, which removes those categories of exposure rather than governing them. Our web analytics is cookieless and sets no identifier.
Two lanes for automation. Anything residency-sensitive moves through the self-hosted lane, end to end, on our own servers. The external automation platform we use for other work holds no credentials for the self-hosted database and has no network path to it. That separation is enforced by configuration, not by convention.
Access
Access to production systems is limited to the people who operate them, and everyone authorised to reach customer data is bound in writing to confidentiality before access is granted — an obligation that continues after they stop working with us.
Multi-factor authentication is enforced on every administrative account, without exception.
Administrative and internal operational interfaces are not exposed on the open internet. They sit behind an access gateway that authenticates every request before it reaches the application.
Administrative actions inside the application are written to an audit log. Infrastructure and application logs are retained for 30 days, and access to them is limited to the people who operate the systems.
Encryption
Customer data is encrypted in transit with TLS, on the public edge and between our own services. It is encrypted at rest on the database volume and in the off-site backups.
Encryption keys are held and rotated by the infrastructure providers that hold the storage, under their key-management schedules. We do not offer customer-managed keys.
How changes reach production
Every change goes through a pull request that a second person reviews before it merges, with automated static analysis and dependency scanning as gates on the merge rather than as advisory reports.
Database schema changes ship as reviewed migrations, applied automatically when the new release starts. Nobody edits a live database by hand.
Patching and vulnerability management
Operating-system security updates are applied automatically as the vendor releases them.
Application and dependency updates go out in scheduled maintenance rounds, with security releases prioritised and applied out of band rather than waiting for the next round.
Dependencies and container images are scanned continuously by automated tooling, on every change.
No third-party penetration test has been carried out. We would rather say that than describe a testing programme we do not run. Security testing by a customer or a researcher is permitted with prior written authorisation, for a defined scope and window — ask at security@electe.net.
Resilience
The database is backed up off-site to a separate provider in a different EU country from the primary hosting, so a hosting-provider failure does not take the backups with it.
Backups run automatically on a 30-day rolling rotation. Restores are exercised when a restore is needed rather than to a published schedule.
That rotation has a consequence worth stating rather than hiding: when data is deleted it is gone from live systems immediately, but persists in a backup for up to 30 further days before being overwritten. During that window it is not processed for any purpose.
Incidents
If we become aware of a personal data breach affecting customer data, we notify the customer within 72 hours of becoming aware of it. The first notice carries what we know at that point rather than waiting for a complete picture, and we follow it as the investigation develops.
Failed logins, port scans and blocked traffic are not breaches and we do not notify them as such.
Vulnerability reports are acknowledged within 72 hours. We do not run a bug bounty and do not pay for reports. If you follow our disclosure terms in good faith we will not pursue legal action against you, and we will not ask your employer or your host to.
What we inherit rather than operate
We own no physical infrastructure. There is no ELECTE office housing production servers, and no self-managed physical server anywhere in the estate.
The following are performed by our infrastructure providers under their contracts with us. We hold them to these controls contractually; we do not perform them, and we do not present them as ours:
- physical access control to data centres, and the monitoring and logging of entry
- environmental controls — power, cooling, fire suppression
- secure disposal and sanitisation of storage media and decommissioned hardware
- physical network infrastructure and its maintenance
Governance and compliance
Sixteen written security policies are in place, written for how this company operates rather than adapted from a template describing teams and facilities we do not have. A summary is available on request.
Confidentiality is one of the general principles of our Ethical Code, signed 12 June 2024, which forms part of our organisational, management and control model under Italian Legislative Decree 231/01.
GDPR — Compliant. Every customer is covered by a data processing agreement.
Data residency — EU. Nuremberg for the application, Milan for backups.
CSA STAR — Level 1 — CAIQ self-assessment v4.0.3, published to the CSA STAR Registry on 17 November 2024. Level 1 is a self-assessment rather than a third-party audit; the submission is renewed annually.
PCI DSS — Held
EcoVadis — Committed
W3C — Member
SOC 2 Type II (audit in progress) — No report has been issued, and until one is there is nothing to send you.
We hold no other security certification or attestation, and we claim none.
Your data, and getting it back
You are the controller of what you put into the platform; we are the processor and act on your instructions. We do not sell customer data, share it for advertising, or use it to build products or profiles of our own, and we do not use it to train or improve any AI model unless you have instructed or authorised it in writing.
On termination you have 30 days to export your data or ask us to return it. We then delete it from live systems within 90 days, and it ages out of backups within 30 further days. Invoices and tax records are the one exception: Italian law requires ten years, and no instruction overrides that.
We do not withhold an export as leverage in a dispute.
Questions, and what to do with them
A security questionnaire, a request for the design of a specific control, or a request for the policy summary: security@electe.net. We answer those without limit and at no charge.
Data-protection questions and the DPA: privacy@electe.net.
Suspected abuse of the platform: abuse@electe.net.