Sovereign and privacy-compliant by design

Are secure software development lifecycle practices (SSDLC) applied to the design, development, deployment and operation of the application?

Platte follows secure development practices, including code reviews, automated and manual testing before release, and a defined change management process.

Is application security tested automatically as part of the development process?

Manual and automated security testing and code reviews are performed for every release, supported by static analysis and AI-assisted analysis.

Are programming interfaces (APIs) developed, deployed and operated in line with leading security practices?

All interfaces are thoroughly examined for vulnerabilities and are protected by security mechanisms that meet industry standards

Are application security risks formally assessed and remediated?

Security risks are assessed during the development process. Identified vulnerabilities are prioritised and remediated before release.

Are independent audit assurance and compliance assessments performed at least annually?

Internal reviews are carried out regularly. External audits are planned.

Are risk-based corrective actions from audit findings tracked through to completion?

Findings from internal reviews are tracked and addressed. Issues reported by customers are logged, prioritised and resolved.

Is a business continuity plan established, documented and maintained?

Platte maintains a Business Continuity & Disaster Recovery plan covering critical business operations, continuity of the website/sales and customer support.

Are business continuity plans tested at planned intervals?

Business continuity procedures, including backup restoration and failover processes, are tested regularly.

Are redundant systems and backups maintained for critical business operations?

All critical systems and backups are operated redundantly

Are change management policies and procedures established and followed?

All software changes follow a defined process, including development, code review, testing and staged rollout.

Is a risk assessment performed before proposed changes are deployed?

Changes are reviewed for potential impact on security, stability and compatibility before release.

Are configuration management practices applied to ensure consistent and secure system states?

Build configurations are stored in version control. Release builds follow a defined, repeatable process.

Are cryptographic controls defined and implemented to protect data?

Encryption for data in transit (TLS/SSL) and at rest (AES-256)

Are procedures established for managing encryption keys?

Encryption keys are stored securely in a key-management solution that meets the current state of the art

Are cryptographic algorithms and protocols used that follow industry standards?

Uses AES-256 for file encryption, TLS 1.2/1.3 for secure connections, and SHA-256 or stronger for integrity checks.

Are physical security perimeters and controls implemented to protect datacenter facilities?

Platte operates no datacenters; our partners’ datacenters are protected to the most modern security standards

Are data classification and data handling policies established?

Platte maintains policies for classifying and handling internal company data as well as customer data, protected by appropriate access controls. The principle of data minimisation is applied.

Are privacy policies aligned with applicable regulations (e.g. GDPR, CCPA)?

A published privacy policy is maintained in compliance with the applicable regulations.

Are there procedures for secure data disposal?

Platte offers secure file deletion features to customers. Internal business data follows secure disposal practices.

Are data retention policies defined and enforced?

Defined retention periods are observed for support records, customer details and business documents.

Is personal data processed in accordance with legal requirements?

Personal data is processed in accordance with the GDPR and applicable local regulations. Documented processes exist for legal bases, purpose limitation and data minimisation. Data processing agreements (DPAs) are concluded with customers; appropriate technical and organisational measures (including access controls, encryption and logging) are implemented.

Is an information security management system established?

Platte maintains an information security policy defining its approach to protecting assets and to risk management.

Are roles and responsibilities for information security defined and assigned?

Security responsibilities are defined in the corporate policies and are overseen at management level.

Is a risk management process implemented to identify, assess and treat risks?

Risks are identified and assessed in the course of ongoing operations and development planning.

Are applicable legal, regulatory and contractual requirements identified and documented?

Platte monitors requirements such as the GDPR and the EU Cyber Resilience Act.

Are background checks performed on employees and contractors?

New personnel with access to sensitive systems or data undergo an appropriate vetting check. All software suppliers and service providers are also thoroughly vetted before contracts are signed.

Are all employees offered security awareness training?

The team keeps its knowledge of security threats and secure coding practices current. New findings are shared within the team on a regular basis.

Are access rights revoked when employment ends?

Procedures exist to withdraw access to all systems and repositories upon departure.

Is a formal user access management process implemented?

Access to development systems, source code and infrastructure is restricted to authorised personnel (need-to-know principle).

Is multi-factor authentication (MFA) enforced for access to critical systems?

MFA is enabled for critical systems such as source code repositories and cloud hosting accounts.

Are access rights reviewed regularly?

Access rights are reviewed regularly and on personnel changes. The principle of least privilege is applied.

Are unique user identifiers assigned and the use of shared accounts prohibited?

All employees have unique credentials; the use of shared accounts is avoided.

Are network security controls implemented to protect the infrastructure environment?

Platte deploys network security controls to protect its (production and development) environments, including network segmentation, restrictive firewall rules (default-deny), hardened remote access (e.g. VPN/SSO), and logging and monitoring of security-relevant events.

Is the network architecture designed with appropriate segmentation and security zones?

The network architecture is designed around a minimal attack surface and uses segmentation/security zones (e.g. separating publicly reachable components, internal services and administrative access). Access is restrictively governed.

Are logging and monitoring functions implemented for critical systems and security events?

Logging is enabled on development systems and the web infrastructure.

Are logs reviewed and retained for an appropriate period?

System and access logs are retained for an appropriate period and reviewed for anomalies.