Security
Your data is in safe hands
Factum (SaaS platform) applies a certified Information Security Management System (ISMS) and technical data protection measures.
Certified ISMS
Hetzner (DE/EU) + Google Cloud
AES-256 (at-rest) + TLS 1.3 (in-transit)
Notification within 24 hours
Certified and Managed Processes
FAKTUM DOO has a fully implemented and certified ISMS according to the international standard for information security.
ISO/IEC 27001:2022
Design, development, support and maintenance of digital legal services.
Confidential Storage and Infrastructure
Factum uses modern cloud infrastructure with high levels of physical protection and compliance.
EU Hosting
Primary services and databases are hosted at Hetzner Online GmbH (Germany/EU) and Google Cloud Platform (GCP).
Physical Security
Data centers are protected with 24/7 physical security, access control, and video surveillance.
Data Storage Compliance
Data is stored in accordance with European regulations and ZZLP.
Legal-Oriented Technical Protection
Practical measures that support confidentiality, integrity, and availability of data.
At-rest (AES-256)
All data stored in databases and file systems is encrypted with AES-256.
In-transit (TLS 1.3 / HTTPS)
All communication between the user and servers takes place via TLS 1.3 (HTTPS).
Authentication
Google OAuth 2.0 or Magic Link for authentication.
Least Privilege
Access to data only when strictly necessary for technical support, regulated by internal policies and NDA.
Segregation (RLS)
Row Level Security (RLS) prevents one client from accessing another client's data.
Your Data. Your Decisions.
Practical measures that support confidentiality, integrity, and availability.
Vulnerability Scanning
Regular scanning of third-party libraries and components for known vulnerabilities (CVEs).
Code Review + Testing
Mandatory Code Review and testing in an isolated environment before production.
Patch Management
Regular updating of systems and servers with the latest security patches.
Backups + Recovery
Daily automatic backups, Point-in-Time Recovery, and Disaster Recovery procedures.
Incidents and Notifications
Procedures exist for the detection, reporting, and resolution of security incidents.
Every security incident will be reported to the Client within 24 hours of discovery, in accordance with legal deadlines and GDPR.
Sub-processors (AI Models)
Factum uses AI models for text processing, with contractual restrictions and technical measures.
Providers
Regular scanning of third-party libraries and components for known vulnerabilities (CVEs).
Encryption in Transit
Data is encrypted during transit.
No Training
Customer data is NOT used to train AI models.
FAQ
Frequently asked questions about Factum security.
Have security questions?
Contact the Data Protection Officer (DPO) for questions related to security and incidents.
FAKTUM DOO Skopje Manager: Dimitar Chukov
