Security

Security at Priva

We treat your compliance data with the same rigour we ask you to apply to your own personal data.

The measures below reflect what is in place today. Items marked Planned are on our roadmap and are not represented as currently active.

Encryption

  • AES-256 encryption at rest
  • TLS 1.2 or higher in transit
  • Encrypted daily database backups
  • Encryption keys managed by our infrastructure provider

Access Control

  • Per-Controller data isolation (row-level security)
  • Role-based access for Controller users
  • Principle of least privilege
  • Multi-factor authenticationPlanned
  • Idle session timeoutPlanned

Infrastructure & Sub-processors

  • Runs on cloud sub-processors named in our Data Processing Agreement
  • Transfers out of Mauritius handled under DPA 2017 s.36
  • No personal data sold or shared

Vulnerability Management

  • Automated patching of managed infrastructure
  • Periodic manual review of security-sensitive code
  • Automated dependency scanningPlanned
  • Independent penetration testingPlanned

Incident Response

  • Breach notification without undue delay (≤72h)
  • Aligned with DPA 2017
  • Documented incident-response procedure
  • Named incident-response contact

Backups

  • Automated encrypted daily backups
  • Defined retention periods
  • Point-in-time recovery on eligible plan
  • Periodic restore testingPlanned

Governance

  • Built around the DPA 2017
  • Appointed Data Protection Officer
  • Staff security & data-protection training
  • ISO 27001 certificationPlanned

Responsible Disclosure

  • security@priva.mu
  • We aim to respond within 48 hours
  • No legal action against good-faith researchers
  • Coordinated disclosure policy

Data Minimisation

  • Collect only what is necessary
  • Retention policy tooling
  • Data-subject rights workflows
  • Right to erasure supported

Questions about our security practices?

Our security team is available at security@priva.mu

View our Data Processing Agreement