Full access journal — every request is logged (user, IP, route, status, module), searchable, with 90-day retention.

Automatic attack detection and blocking — vulnerability scans (.env, .git, wp-admin) are auto-blocked, with real-time alerts.

Anti-brute-force login protection — repeated attempts trigger alerts and temporary IP blocking.

Role-based access (RBAC) and need-to-know — personal connection data is not visible by default to other users.

Emergency kill-switch (panic mode) — access can be blocked instantly, partially or fully, with automatic recovery after 2 hours.

Encryption in transit (HTTPS/TLS) and at rest; sensitive data (tokens, IBANs) additionally encrypted at the application level.

Continuous uptime and security monitoring, with an internal access dashboard (journal, threats, blocked IPs).

Security breach notification to clients within 48–72 hours (standard DPA contractual term).

Data controller: CIBINNO CONSULTING S.R.L. Data protection contact point: contact@cibinno.ro.

Legal bases: legitimate interest (commercial outreach), contract performance (support), explicit consent (Open Banking / PSD2).

Data minimisation — we collect only what the purpose strictly requires. No profiling and no automated decisions with legal effects on individuals.

Processing within the European Economic Area. Banking data is NOT sent to external AI models.

Data subject rights: access, rectification, erasure, restriction, objection, portability, consent withdrawal — at contact@cibinno.ro. One-click unsubscribe.

Retention and erasure — data is kept until the purpose is met or objection; for Open Banking, limited consent (usually 90 days) with re-authorisation and irreversible deletion on request.

Traceability — every relevant operation (connect, sync, re-authorise, delete) is recorded in an audit journal.

Right to complain to the supervisory authority (ANSPDCP, dataprotection.ro).

Microsoft Azure infrastructure, in European Union data centres (West Europe / Sweden Central).

The AI component uses Azure OpenAI Service in an EU region — data stays within European jurisdiction.

Email and productivity via Microsoft 365 and Azure Communication Services, processed within the EEA.

Encryption at rest via Azure; TLS terminated at ingress (end-to-end HTTPS).

Regular off-site backup — daily copies, typical 30-day retention, plus an off-site copy of critical data.

Active Disaster Recovery — automated daily checks and periodic restore drills, with verified Azure restore points.

Fast rollback to a previous stable version in case of a deploy incident.