Sigurnost u YARDtwin

YARDtwin radi na Microsoft Azure infrastrukturi s računalnim resursima u Norway East i pohranom podataka, registrom i tajnama u Sweden Central. Svi podaci korisnika ostaju unutar EU/EEA, u skladu s člancima 44–49 GDPR-a.

• App Service (Linux Container) — Norway East
• Azure PostgreSQL Flexible Server — Sweden Central
• Azure Blob Storage — Norway East, privatni spremnici
• Azure Key Vault — Sweden Central, kontrola putem RBAC
• Azure Front Door + WAF — način prevencije
• Log Analytics + Microsoft Sentinel — zadržavanje 90 dana

All customer data is stored and processed within the EU/EEA — hosted in Microsoft Azure’s Ireland and West/North Europe regions. Creation of resources outside the approved EU regions is blocked at the platform level by an Azure Policy “Deny” rule, so customer data cannot be provisioned outside the EU/EEA. Where a limited-scope sub-processor operates outside the EU (for example AI OCR or email delivery), transfers are governed by EU Standard Contractual Clauses and only the minimum data necessary is sent.

YARDtwin uses a small, vetted set of sub-processors to deliver the service. Each is bound by a Data Processing Agreement. We maintain this register and notify customers of material changes in line with GDPR Article 28.

YARDtwin uses AI to read driver licences and shipping documents (OCR), to power the in-app assistant, and to generate voice guidance. AI processing is assistive: its output is presented to a person — for example a gate operator confirms every check-in — and YARDtwin does not make automated decisions producing legal or similarly significant effects on individuals (GDPR Article 22).

• Customer data is not used to train third-party AI models — our AI sub-processors process data only to return a result for your request.
• Data minimisation: AI document OCR can be switched off per site, so sites that prefer manual entry never send documents to an AI provider.
• Human oversight: extracted fields are reviewable and editable before they are committed to the record.

Strogi CSP s jednokratnim oznakama (nonce) po zahtjevu za skripte (bez unsafe-inline). Potpun skup sigurnosnih zaglavlja vraća se uz svaki odgovor: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy.

Neovisno penetracijsko testiranje 17.–18. travnja 2026. (10 OWASP kategorija, 36 payloada): 0 ranjivosti.Funkcionalno sigurnosno testiranje 11. travnja 2026. koje obuhvaća više od 1 890 API poziva kroz 270 termina: 0 grešaka.Godišnji penetracijský test treće strane planiran, SOC 2 Type II revizija u tijeku.

• EU GMP Annex 11 — Integritet podataka (ALCOA+), samo-dodavajući revizijski trag, elektronički zapisi, kontrola pristupa, validirano
• 21 CFR Part 11 — Elektronički zapisi, revizijski trag, atribucija, lanac nadzora pečaćenja
• GDPR — Prenosivost podataka (JSON + CSV), DSAR proces, praćenje privole, pohrana isključivo u EU/EEA
• SOC 2 Type II — Revizija u tijeku

• Predložak Ugovora o obradi podataka (DPA) — za pregled i potpis od strane poduzeća
• GDPR pravila
• Pravila privatnosti
• security.txt

Pozdravljamo prijave sigurnosnih istraživača. Pošaljite e-mail na admin@yardtwin.coms opisom nalaza i koracima za reprodukciju. Potvrđujemo primitak unutar 2 radna dana i nastojimo ispraviti kritične probleme unutar 7 dana. Molimo vas da ne objavljujete ranjivosti javno prije nego što imamo priliku provesti popravne mjere.