Version 2026-11-12
Security and incident handling
This security Annex B describes access control, protection of messages and attachments, logging, incident handling and the scope of documented operational guarantees. The controls must reduce and manage risk throughout the service’s lifetime.
Contents
1. Access and tenant isolation
Access is linked to authenticated membership, workspace and validated hostnames. Roles and inbox permissions are checked on the server, with database rules providing additional protection. Attachment access is checked before short-lived links are issued.
Platform administration requires specific access and two-factor authentication. Support access has a stated reason, a short-lived redemption ticket and a time-limited session. Access and relevant actions are recorded so that the actual administrator and workspace can be traced.
2. Handling messages and secrets
The application encrypts stored provider secrets, verifies webhook signatures and includes mechanisms to reduce repeated processing and unintended duplicate sending. Access to keys and operational secrets must be restricted.
Message HTML is sanitised, external images are restricted, and attachments undergo file-content checks and scanning before use through approved flows. Attachments are held in private storage with controlled access. The controls reduce risk and must be maintained against new threats.
3. Operations, logging and change control
Development, staging and production must have separate data and credentials. Deployments, access changes and security fixes must follow controlled procedures. Relevant logging must have restricted access and exclude message content, attachments and secrets by default.
The API error overview contains limited technical fields. It does not replace all operational and security logs. Retention, access and cleanup must be confirmed for each log source and provider.
4. Backups and recovery
Svarlane must maintain appropriate recovery measures under Article 32 GDPR. The database, object storage, queues and necessary configurations must be assessed together. This overview specifies no quantified backup frequency, maximum copy retention or guaranteed limits for data loss and downtime. Specific guarantees apply only where documented and separately agreed.
A provider’s available backup feature does not alone document a particular configuration at Svarlane. Documentation of the actual configuration, relevant controls and a completed recovery test must be available as necessary information under the data processing agreement.
5. Incidents and notification
An incident procedure must cover receipt of reports, access restriction, evidence preservation, investigation, impact assessment, customer notification and remediation. Affected customers are notified without undue delay upon awareness of a personal data breach. Information may be updated as it becomes available.
Pelle Lindal is the contact point for security follow-up through info@svarlane.no. A specific response time or round-the-clock incident response applies only where separately agreed. Statutory notification must nevertheless take place without undue delay. Notification to authorities and communication to data subjects are assessed under data protection law and the specific role.
6. Reporting vulnerabilities
Vulnerabilities and security incidents should be reported to info@svarlane.no. Provide the affected feature, time and necessary technical steps to reproduce the issue. Agree a secure channel before sharing customer content or other sensitive information.
Security testing must be limited to your own accounts and data or a scope agreed in writing. Access to other people’s data, changes to production data and load that may harm operations require a separate agreement. Receipt of a report does not in itself promise payment, amnesty or permission for further testing.
7. Verification and documentation
The customer may request necessary security documentation under the data processing agreement. Provider certifications apply within their own scope. Any claim of certification, penetration testing, specific uptime or complete compliance must be documented for Svarlane.
The documentation must enable an assessment of production locations, subprocessors, deletion and copy expiry, backups and necessary incident handling. Svarlane must disclose relevant limitations and deviations that affect the customer’s processing. An exclusion of liability does not replace statutory security measures.
Official references and provider terms
These references provide legal and provider information. Svarlane’s agreements and active configuration determine the applicable processing arrangements.