Technical and Organisational
Security Measures (TOMs)

4.1 Pseudonymisation

Meeting data is stored with internal database identifiers (UUIDs) that are dissociated from direct participant identifiers at the application layer. User passwords are stored using industry-standard secure hashing. AI processing uses meeting IDs rather than participant names wherever technically feasible.

4.2 Encryption

At Rest: All database storage (AWS RDS) and cloud object storage is encrypted using AES-256 at the AWS storage layer. Compute instance storage is encrypted at rest.

In Transit: All communication is enforced over TLS 1.3. Audio data is transmitted via WebSocket Secure (WSS) — the real-time audio stream from users' browsers to the Echory processing service is encrypted end-to-end. API calls to third-party services (Deepgram, OpenAI) use HTTPS/TLS 1.3.

Secrets Management: Application credentials, API keys, and service tokens are managed via secure storage mechanisms. Access to credentials is restricted on a need-to-know basis.

4.3 Physical Access Control

Physical security is fully delegated to Amazon Web Services EMEA SARL. AWS data centres are certified to ISO 27001, SOC 1/2/3, and ISO 27017/27018. Physical access is restricted to authorised AWS personnel only, with biometric controls, CCTV monitoring, and perimeter security maintained by AWS. Echory maintains no physical server infrastructure of its own.

4.4 System & Electronic Access Control

• AWS IAM enforced for all cloud resource access — no shared root credentials in use
• TOTP-based MFA (authenticator app) required for all AWS IAM accounts
• Unique credentials per team member; no shared service accounts
• Production server access restricted to authorised personnel with key-based authentication
• Application authentication uses secure tokens managed by the application framework
• Access rights reviewed and revoked promptly upon role change or departure
• Rate limiting applied to authentication and sensitive endpoints

4.5 Internal Access Control — Need-to-Know

Access to personal data is restricted on a strict need-to-know basis. Production data access is limited to personnel with a documented operational requirement. Development and staging environments are separated from production, with no cross-environment data flows.

Development Sub-processor Access Model: INSTRAT Technology ApS (development sub-processor) operates under a scoped access model for production environments. Access is granted per documented task, logged, and subject to Echory's oversight. All access is governed by contractual data processing obligations.

4.6 Isolation & Separation Control

• AWS VPC with private subnets isolates database and internal services from the public internet
• Separate environments: production, staging, development — no cross-environment data flows
• Customer data is logically separated at the database level (per-customer identifiers)
• Microservice separation: API, socket service, and database operate as independent components
• Network access controls implemented at both Security Group and subnet level

4.7 Application Security

• CSRF protection enabled on all state-changing API endpoints
• Parameterised queries via ORM layer — SQL injection protection by default
• Input validation and sanitisation on all user-supplied data
• Session protection: HttpOnly and Secure cookie flags enforced
• Rate limiting applied to authentication and sensitive endpoints
• Security headers configured on all responses
• Dependency security vulnerabilities monitored in the development workflow

4.8 Secure Development & Release Management

• All code changes require a Pull Request with at least one approved reviewer before merge to the main branch
• Infrastructure changes managed as Infrastructure-as-Code
• No direct production deployments without Pull Request review — branch protection enforced
• Dependency updates tracked and applied regularly; critical security patches applied on an expedited timeline

4.9 Infrastructure, Hosting & Network Security

• All services hosted on AWS eu-central-1 (Frankfurt, Germany) — EU data residency for all primary processing
• Security Groups configured as allowlists — default-deny for all inbound traffic
• Access to production infrastructure restricted to authorised personnel; access controls reviewed regularly
• TLS certificates managed with automated renewal
• Network ACLs provide additional subnet-level traffic filtering

4.10 Logging, Monitoring & Traceability

• Infrastructure and application logs aggregated via AWS CloudWatch
• Infrastructure and API activity logging implemented for cloud resource access
• Application-level logging records authentication events and system errors
• Alerting configured for anomalous access patterns and service degradation
• Log retention periods defined per security policy

4.11 Vulnerability & Patch Management

• OS and runtime patches applied on a regular schedule; critical patches applied on an expedited basis
• Application dependencies monitored for known security vulnerabilities (CVEs)
• AWS-managed services receive automatic minor version patches
• Regular security assessments of the platform are performed

4.12 Backup, Recovery & Business Continuity

• Database backups stored in encrypted AWS-managed storage (AES-256)
• Point-in-time recovery capability enabled for the database
• Business continuity procedures maintained and reviewed regularly

4.13 Personnel Security & Confidentiality

• All personnel and contractors with access to personal data are bound by confidentiality agreements
• Data protection awareness training provided to all team members with data access
• Access rights reviewed and revoked within one business day of role change or termination
• Sub-processors (including INSTRAT Technology ApS) are contractually bound to equivalent security obligations

4.14 Endpoint Security

• Screen lock and auto-lock policy enforced on all team devices
• Malware and endpoint protection software installed on all team devices
• Device security policies are reviewed regularly and updated as the team grows

4.15 Data Retention, Deletion & Return

• Personal data deleted within 30 days of contract termination
• Customer may request earlier deletion in writing; Echory will action within 5 business days
• Audio recordings are session-scoped — not persisted after the transcription pipeline completes
• Transcripts and AI outputs retained per controller instructions or DPA schedule
• Secure deletion procedures applied — data overwritten or cryptographically erased
• Deletion certification available on request

4.16 Job Control — Processor Obligations

• Echory processes personal data solely on documented instructions from the controller
• Sub-processors are engaged only with controller awareness and under binding data processing agreements
• Echory assists controllers with Art. 32–36 GDPR obligations upon request
• Security incident notification to controller within 24 hours of Echory becoming aware

Audio Lifecycle

Audio is captured in the user's browser and transmitted via an encrypted WebSocket connection (WSS) to Echory's processing service hosted on AWS eu-central-1. It is forwarded to Deepgram's EU endpoint (api.eu.deepgram.com) for real-time speech-to-text conversion, with all audio transcription processing localized within the EU/EEA. The resulting transcript is then processed by Echory's AI pipeline. Audio is not persisted beyond the active session — it is deleted once transcription is complete.

Shared Responsibility

Availability & Support

• Monthly uptime commitment: 98% measured availability per calendar month
• Support hours: Monday–Friday 08:00–17:00 CET/CEST (excluding North Rhine-Westphalia public holidays)
• Scheduled maintenance window: Daily 00:00–02:00 CET/CEST — planned maintenance within this window is excluded from uptime calculations

Data Breach Notification

• Echory notifies the controller within 24 hours of becoming aware of a confirmed or suspected personal data breach
• The controller is responsible for notifying the competent supervisory authority within the statutory 72-hour window (Art. 33 GDPR)
• Breach notification includes: nature of breach, categories and approximate volume of data affected, likely consequences, and mitigation measures taken or planned
• Post-incident review conducted for all P1 and P2 incidents; findings documented and acted upon

Supplementary Technical Safeguards

• Minimum data transfer principle: only data strictly necessary for the specific processing task is transmitted to third-country recipients
• No-training contractual clauses with both Deepgram and OpenAI prohibit use of customer data for model training or improvement
• Audio is not retained by Deepgram beyond the active transcription session
• INSTRAT Technology ApS production access is scoped, task-bound, and logged (see §4.5)
• Transfer Impact Assessments for transfers to the United States are maintained to supplement the SCCs