Security & Compliance
Cadensa is committed to data security and compliance with international security standards. This page details our technical security measures, compliance certifications, and incident response procedures.
Trust & Compliance
EU Hosted
Data stored within the EU
GDPR Compliant
EU 2016/679 · documented processes
Germany, EU
ISO 27001 · EU datacenter
🔒 Security Overview
Cadensa provides enterprise-grade security across all service tiers. Protecting your data is our highest priority.
AES-256 at rest, TLS 1.3 in transit
Hetzner (Germany, EU) + OVHcloud Managed MongoDB (France, EU), daily backups
GDPR, SOC 2 (planned, for ENTERPRISE customers)
Tenant isolation and internal access
Every enterprise security questionnaire asks this first, so we answer it up front.
Separation between customers
Each organisational unit gets its own separate database (database per tenant, not shared tables with a tenant column). A middleware layer binds every request to the signed-in user’s unit, so even a faulty query cannot reach into another customer’s database.
How many people have production access
Currently one natural person: the managing director. That is both a strength (a very small attack surface, no forgotten ex-employee accounts) and a limitation (no four-eyes principle). As the team grows, access will be tied to roles and this page will be updated.
Signing in to a customer account (impersonation)
The product has no “sign in as user” button: we cannot step into your account for support. For debugging, direct database access is the last resort, and every such intervention is logged. If a support case would require looking at workspace content, we ask for permission first and record it in writing.
What we deliberately do NOT collect
Some time tracking tools have grown into surveillance software. Cadensa is not one of them, and that is a design decision rather than a missing feature — if a capability is absent, the data never exists, so it cannot leak and needs no legal basis.
| Capability | Status |
|---|---|
| Screenshots, screen recording, session replay | ❌ None, and not plannedOur error logger (Sentry) supports session replay, but it is switched off: only error events and performance samples are sent, never screen content. |
| Keystroke or mouse tracking, “activity score” | ❌ None, and not planned |
| Location tracking, background GPS | ❌ None |
| Camera or microphone access | ❌ None |
| Logging of visited websites or running applications | ❌ None |
| Automated performance scoring or ranking | ❌ None — reports are descriptive statistics |
| Using customer data to train AI models | ❌ None, and never without a separate agreement with the controller |
This list can be used directly in works council consultations (BetrVG §87(1) no. 6) and staff information notices. We also issue it in signed form on request.
1. Data Encryption
Encryption at Rest
All data is stored with AES-256 encryption in our databases and backup systems.
- • AES-256-GCM: Industry-standard encryption algorithm
- • Encrypted database: OVHcloud Managed MongoDB — encryption at rest (AES-256, managed)
- • Encrypted backups: Daily automated backups with encrypted storage
- • Key management: Secure key storage (secrets management)
Encryption in Transit
All network communication is protected with TLS 1.3 encryption.
- • TLS 1.3: Latest TLS protocol version
- • HTTPS: All web traffic over HTTPS only
- • WebSocket: Encrypted real-time connections (WSS)
- • Third-party APIs: Mollie (all TLS 1.2+)
Password Protection
Passwords are stored using bcrypt hashing algorithm (12 rounds).
- • Bcrypt (12 rounds): Secure hashing with salt
- • Password requirements: Min. 8 chars, upper/lower, number, special char
- • Strength validation: Real-time password strength indicator
2. Access Control
Role-Based Access Control (RBAC)
Granular permission management based on roles and permissions.
- • Roles: OWNER, ADMIN, MANAGER, MEMBER, VIEWER
- • Permissions: Granular permissions per resource (projects, tasks, time entries, reports, billing)
- • Workspace-level permissions: Each workspace with separate permissions
Two-Factor Authentication (2FA)
Optional 2FA available on all tiers (TOTP-based).
- • TOTP (RFC 6238): Google Authenticator, Authy, 1Password compatible
- • Backup codes: 10 one-time recovery codes
- • Organisation-wide mandatory 2FA: planned, not available yet
Session Management
JWT-based sessions with server-side revocation on sign-out.
- • JWT tokens: 7-day validity
- • Revocation: On sign-out the token goes onto a server-side deny list (Redis) until its natural expiry — signing out takes effect immediately, not just in the browser
- • Login history: Successful and failed sign-ins are logged with IP and device string
- • Planned: A device list with per-device termination, and automatic logout after inactivity. Neither exists today: a session left open on another device stays valid until the token expires (up to 7 days) unless you sign out there.
🔄 SSO & SAML (ENTERPRISE — planned)
SAML/LDAP-based Single Sign-On is not available yet — it is in development for the ENTERPRISE tier. Today you can sign in with email + password or with a Google account (OAuth).
- • Available today: Google OAuth sign-in, email + password
- • Planned: SAML 2.0 (Okta, Microsoft Entra ID, Google Workspace), LDAP
IP Allowlisting (ENTERPRISE)
Restrict access to specific IP addresses.
- • Access only from whitelisted IP addresses
- • CIDR notation support
- • Workspace-level IP restrictions
3. Infrastructure Security
The full list of providers behind this infrastructure — with contracting entity, storage location and transfer basis — is on the Sub-processors page.
Hosting & Data Center
Hosted on Hetzner Online GmbH dedicated servers (Germany, EU).
- • Location: Germany (EU), GDPR compliant
- • ISO 27001: Hetzner datacenter certified
- • Physical security: 24/7 monitoring, biometric access
- • Power supply: Redundant UPS and generators
Backups
Daily automated backups with encrypted S3 storage on a rotating retention schedule.
- • Frequency: Daily full backup (2:00 AM CET)
- • Retention: Daily backups for 30 days, weekly for 6 months, monthly for 2 years
- • Encryption: AES-256-GCM symmetric encryption before upload
- • Storage: Wasabi S3 (eu-central-2, Frankfurt) — GDPR-compliant, EU data center
- • Integrity: SHA-256 checksum for every backup file
- • Recovery time: RTO < 4 hours, RPO < 24 hours
Server Hardening
Regular security updates and server hardening.
- • OS updates: Weekly automated security patches
- • Firewall: Only necessary ports open (443, 80)
- • Fail2ban: Brute-force protection
- • Minimal surface: Only necessary services running
Network Security
Multi-layer network protection with firewalls and DDoS mitigation.
- • DDoS protection: Hetzner automatic DDoS mitigation
- • Rate limiting: API rate limits on all endpoints
- • Application-layer filtering: Helmet security headers (CSP, HSTS, X-Frame-Options) and a strict CORS allowlist
📊 Service Level Agreement (SLA)
ENTERPRISE tier customers get a 99.9% availability commitment and priority support with a named contact person.
- • Uptime: 99.9% (max ~43.2 min downtime/month)
- • Applies to: ENTERPRISE tier customers
- • Support: priority email support, first response within 4 business hours, with a named contact person
- • Compensation: Service credits for SLA violations (details: support@cadensa.io)
📋 SLA & Support Comparison by Tier
SLA and support level depend on your selected tier:
| Tier | Uptime SLA | Support | Account Manager |
|---|---|---|---|
| FREE | No SLA | Community | — |
| PRO | No SLA | Email, on business days | — |
| ENTERPRISE | 99.9% (~43 min/mo) | Priority email, response within 4 business hours | Named contact person |
4. Application Security
Security Headers
HTTP security headers in all responses (Helmet middleware).
- • Strict-Transport-Security (HSTS): Force HTTPS for 1 year
- • X-Content-Type-Options: Prevent MIME sniffing
- • X-Frame-Options: Clickjacking protection
- • Content-Security-Policy (CSP): XSS protection, resource loading rules
- • X-XSS-Protection: Enable browser XSS filter
Input Validation
Strict input validation on all API endpoints.
- • Joi validation: Schema-based validation
- • Sanitization: HTML/SQL injection protection
- • Type checking: TypeScript type safety
Audit Logging
Detailed audit logs for all critical operations.
- • Login/logout events (successful and failed)
- • Data modifications (create, update, delete)
- • Role changes
- • Security events (2FA, password change)
- • Retention: 30 days (FREE), 90 days (PRO), 1 year (ENTERPRISE) — security events are kept for 1 year on every plan
Dependency Scanning
Automated vulnerability alerting on every repository.
- • Dependabot alerts: Enabled on all four of our repositories. GitHub continuously matches our lockfiles against the Advisory Database and notifies us when a vulnerability is published in a dependency — or in one of its dependencies, at any depth
- • Dependabot security updates: Enabled — GitHub automatically opens a pull request bumping the package to the fixed version
- • SonarQube: Configured for the backend and the frontend, but the job is currently switched off (“temporarily disabled”), so it does not run today. Turning it back on is on our task list.
- • npm audit: Manually, before dependency bumps — as a second check alongside Dependabot
- • What we do not promise: a fixed remediation deadline. The alerting is automatic, but triage and release are human work, and Cadensa is run by a small company. A critical vulnerability on the production path takes priority over everything else — but we will not put a figure in hours here that we could not hold at night or over a holiday.
5. Compliance Certifications
✅ GDPR (EU 2016/679)
Our processing is built to the requirements of the GDPR. This is a self-assessment, not a certificate — the GDPR has no general certification; Article 42 schemes (e.g. Europrivacy) are issued by accredited bodies, and we hold none.
- • Transparent data processing information
- • Data subject rights support (Article 15-22)
- • DPA on every plan, as an annex to the Terms, effective on registration (Article 28)
- • Data breach: to the NAIH within 72 hours as controller, to the customer acting as controller within 48 hours as processor
- • Data sits in EU data centres; two sub-processors (Vercel, Wasabi) are US-incorporated with EU storage — details on the Sub-processors page
🔄 SOC 2 Type II
Not yet certified, no audit currently in progress
- • Current status: On our compliance roadmap for ENTERPRISE customers
- • Planned certification: No fixed date yet (audit typically takes 6-9 months)
- • Available for ENTERPRISE tier customers
🔄 ISO 27001
Not yet certified, the certification process has not started
- • Current status: Internal gap analysis done; no contract with a certification body
- • Planned certification: No target date. This page previously said Q4 2026; that is untenable, since the process takes 6–9 months and has not begun. We would rather give no date than miss one.
- • The Hetzner data centres hosting our servers are ISO 27001 certified — that is their certification, not ours.
✅ PCI DSS
Mollie payment processor (PCI DSS compliant).
- • Card data never touches Cadensa servers
- • Mollie tokenization
- • 3D Secure (SCA) support
6. Incident Response
Data Breach Notification Obligation
In our role as processor (for workspace content data), under GDPR Article 33(2) we notify the customer acting as controller without undue delay and within 48 hours of becoming aware of a breach — reporting to the supervisory authority is their decision and obligation. If not all information is available by then, we continue in phases under Article 33(4). As a controller (account, billing and security log data) we report to the Hungarian DPA (NAIH) within 72 hours under Article 33(1).
Who responds to an incident
Plainly: Cadensa is run by a small company, not by a multi-shift on-call rota. We would rather say so than promise something we could not hold up during an actual incident.
- • Detection: automated monitoring and alerting around the clock, without needing a human in the loop
- • First responder: the managing director, alerted on mobile; also outside business hours, but without a guaranteed instant presence
- • Reporting: the security@, privacy@, legal@ and support@ addresses all reach the same person — the split helps triage, it does not stand for separate teams
Response Time Targets by Severity
These are targets, not contractual guarantees. A contractual availability commitment applies to the ENTERPRISE plan only.
| Severity | Initial Response | Investigation | Status Update |
|---|---|---|---|
| Critical | < 1h | 24h | 6-12h |
| High | < 4h | 2-3 days | Daily |
| Medium | < 24h | 1 week | Weekly |
| Low | < 7 days | 90 days | As scheduled |
📋 Critical: data breach, unauthorized access, system-wide outage
Incident Reporting Process
- Detection: Automated monitoring + user report
- Categorization: Severity assessment (S0-S4)
- Containment: Incident containment and mitigation
- Notification: Notify the customer acting as controller without undue delay, within 48 hours; in phases if needed
- Investigation: Root cause analysis
- Recovery: Service restoration
- Post-mortem: Documentation and lessons learned
Communication Channels
- • Security incidents:
- • Data breaches:
- • Status page: status.cadensa.io
7. Vulnerability Disclosure Program
🔒 Responsible Disclosure Policy
We welcome security researchers who responsibly disclose vulnerabilities. Please send your report to .
Reporting Process
- Send a detailed report to
- We send an acknowledgment — usually within 24 hours, at the latest within 3 business days
- Collaborate during the fix
- Coordinate public disclosure
Out of Scope
- • Social engineering attacks
- • Physical attacks
- • DDoS
- • Spam or phishing
Fix SLAs
- • Critical: 24 hours
- • High: 7 days
- • Medium: 30 days
- • Low: 90 days
Bug Bounty Program
Roadmap: 2026 Q3 (on HackerOne or Bugcrowd platform)
8. Contact & Questions
Security questions:
Privacy questions:
Compliance questions:
Response time: 24 hours (business days)
Axeri Labs Bt. (CADENSA)
2120 Dunakeszi, Brassói utca 7., Hungary
Company registration: 13-06-060656
Tax number: 22531300-2-13
Related Documents:
Language of this document
This document is authored in English and Hungarian. On other language interfaces the English text is shown. In case of any discrepancy between the two versions, the English text prevails — except where the contracting party is a consumer resident in Hungary, in which case the Hungarian version applies. If you spot a discrepancy between the versions, please tell us at legal@cadensa.io and we will fix it.