GDPR Policy

All data encrypted in transit (TLS 1.2+). Passwords hashed with bcrypt (12 rounds). PostgreSQL Flexible Server uses transparent data encryption at rest. Azure Blob Storage encrypted at rest. Driver licence images and signatures are encrypted at rest with AES-256 by Azure Storage and Azure Database for PostgreSQL (Microsoft-managed keys), and access to them is limited by role and organisation. JWT tokens cryptographically signed (HS256). Secrets managed via Azure Key Vault accessed by App Service managed identity — no secrets in code, environment files, or container images.

Role-based access control (RBAC) on authenticated routes, with tenant scoping enforced server-side. Tenant isolation is tested automatically before every release: the release gate’s cross-tenant sweep calls the API as one organisation with another organisation’s record IDs, and the release is blocked if any of that organisation’s data can be read or changed. Single sign-on (SAML 2.0, Google, Microsoft); time-based one-time-password MFA, mandatory for platform administrators and available to all users.

Complete audit logging of user actions: user identity, timestamp, IP address, action verb, entity affected, old and new values. GMP-relevant actions flagged separately (is_gmp_relevant=1). Tamper-evident and append-only, enforced in the database with a hash chain; GMP-relevant entries retained for at least 7 years while the service agreement runs, other audit entries for 365 days. Pseudonymised but not deleted on Art. 17 erasure (Art. 17(3)(b) legal-obligation override). At the end of the contract the customer is given a complete export of its audit trail before it is deleted, unless it declines it in writing or cannot be reached after reasonable attempts; YARDtwin keeps it longer only on the customer's written instruction, apart from backups until they expire and its own record of the handover.

Hosted on Microsoft Azure (Sweden Central + Norway East, EEA). Containerised App Service deployed via Azure Container Registry with staging-slot-then-swap. Traffic reaches the application through Azure Front Door with a Web Application Firewall in Prevention mode; the database accepts connections only from Azure services and an administrator IP allow-list. Application Insights with schema-drift alert on Postgres "column / relation does not exist" errors (15-minute window). End-to-end /health/db-write probe verifies the application can write+read the database on every deploy.

We only collect data necessary for service delivery. Optional driver fields (phone, email) can be left blank where the customer’s process allows. Gate staff may take a face photo of the driver as gate evidence. Where a site turns on AI face comparison, our AI provider (Anthropic) compares that photo one-to-one with the licence photo or the driver’s stored photo to help staff confirm the driver’s identity. The result is advice: gate staff decide, and can admit a driver the comparison did not confirm by giving a reason. Each comparison is recorded on our servers with its result. Where face comparison is off (the default), no face photo is sent to the AI provider and staff compare the driver with the licence photo themselves; licence images are still read by AI where AI reading is on. YARDtwin stores no face templates and performs no one-to-many identification. Newsletter only collects email and optional company name.

Every pull request must pass npm audit (dependency vulnerabilities), Semgrep (static analysis) and gitleaks (secret scanning) before it can be merged, with a Trivy container image scan as an advisory check; these checks also run on every push to master and nightly, together with an advisory OWASP ZAP baseline scan (dynamic testing) of the production site. Dependabot alerts report newly disclosed vulnerabilities in our dependencies.