Technical and Organisational
Security Measures (TOMs)

echory acts as processor on behalf of its customers, or as sub-processor where the customer itself acts as a processor. These measures apply to all personal data processed via the echory real-time AI decision support platform.

• All processing infrastructure is hosted on AWS eu-central-1 (Frankfurt, Germany)
• Personal data does not leave the European Economic Area except as disclosed in the sub-processor register, where transfers are covered by Standard Contractual Clauses
• echory maintains no physical server infrastructure of its own; physical security is delegated to Amazon Web Services EMEA SARL (ISO 27001, SOC 1/2/3, ISO 27017/27018)

• AWS IAM enforced for all cloud resource access; no shared root credentials in use
• TOTP-based multi-factor authentication required for all AWS IAM accounts
• Unique credentials per team member; no shared service accounts
• Access to personal data restricted on a strict need-to-know basis; production access requires a documented operational requirement
• Production, staging and development environments are separated, with no cross-environment data flows
• Access rights reviewed and revoked within one business day of role change or departure
• Application users can enable two-factor authentication using a one-time code delivered by e-mail
• Rate limiting applied to authentication and sensitive endpoints

• Database backups are stored in encrypted AWS-managed storage (AES-256)
• Infrastructure and application logs are aggregated via AWS CloudWatch; authentication events and system errors are logged
• Alerting is configured for anomalous access patterns and service degradation
• OS and runtime patches are applied on a regular schedule; critical patches on an expedited basis. Application dependencies are monitored for known vulnerabilities

echory engages sub-processors under written terms governing security and confidentiality. The current register, which names each sub-processor, its role, its processing location and the applicable transfer mechanism, is maintained at:

Changes to the register are notified to controllers in accordance with the DPA, which also governs the notice period and the customer's right to object.

• All personnel and contractors with access to personal data are bound by confidentiality agreements
• Data protection awareness training is provided to all team members with data access
• Screen lock and auto-lock policies are enforced on all team devices
• Malware and endpoint protection software is installed on all team devices
• Sub-processors are contractually bound to equivalent security obligations

• Personal data is deleted within 30 days of contract termination
• Customers may request earlier deletion in writing; echory will action such requests within 5 business days
• Audio recordings are session-scoped and are not persisted after the transcription pipeline completes
• Transcripts and AI outputs are retained per controller instructions or the DPA schedule
• Secure deletion procedures are applied: data is overwritten or cryptographically erased
• Deletion certification is available on request

Export of customer data on switching is governed by Annex 3 (Data Act Addendum) and the echory Data Register.

• echory notifies the controller within 24 hours of becoming aware of a confirmed or suspected personal data breach
• The notification includes the nature of the breach, the categories and approximate volume of data affected, the likely consequences, and the mitigation measures taken or planned
• The controller remains responsible for notifying the competent supervisory authority within the statutory 72-hour window (Art. 33 GDPR)
• A post-incident review is conducted for all critical and high-severity incidents; findings are documented and acted upon

Questions regarding these measures: security@echoryflow.com