Technical and organisational measures (TOMs)

This is an English translation for convenience. The German version is legally binding.

Technical measures

Access controls

  • Two-factor authentication (2FA): Access to the production systems is only possible with two-factor authentication.
  • Role-based access control (RBAC): In accordance with the principle of least privilege, employees only have access to the data they need for their tasks.
  • Restricted access to servers and databases: Only authorised persons have access to systems, databases and servers; access is secured by strong passwords and 2FA.
  • Automated logging: All access to personal data and systems is logged automatically and can be reviewed where necessary.

Encryption

  • Encryption in transit: All data transfers take place exclusively over encrypted connections using modern protocols (e.g. TLS).
  • Encryption at rest: Personal data stored on the servers is encrypted using current methods such as AES-256.
  • Payment data: Card data is collected and processed exclusively by our PCI-DSS-certified payment service provider; tastee does not store it.

Network and system security

  • Firewall and intrusion detection system (IDS): The networks are protected by firewalls and equipped with an IDS in order to detect unauthorised access attempts at an early stage.
  • Protection against DDoS attacks: Protective measures against distributed denial-of-service attacks ensure the availability of the services.
  • Patch management: Operating systems, software components and the App are updated regularly in order to close known vulnerabilities.

Monitoring and logging

  • Access and activity logs: All access and relevant actions (e.g. login attempts, data changes) are logged and reviewed regularly.
  • Automated monitoring: The systems automatically detect suspicious activity and trigger alerts where necessary.
  • Retention of logs: In accordance with the legal requirements, logs are retained securely for 12 months.

Data backup

  • Regular backups: Backups of the production database are created, tested and stored securely on a regular basis.
  • Geo-replication: Backups are stored at several geographically separate locations in order to prevent data loss.

Vulnerability management

  • Security review of changes: New features and system changes are checked for vulnerabilities before they go live.

Organisational measures

Internal documentation, awareness and training

  • Internal directive: A company-wide directive on the protection of personal data sets out the rules for handling personal data securely.
  • Awareness and training: All employees receive regular training on the principles of data protection, password security, the secure handling of information and the recognition of phishing attacks.

Restriction of access

Access to personal data is granted on the basis of clearly defined roles and responsibilities and is systematically documented.

Record of processing activities

All processing activities are documented in a record setting out their nature, purpose, the categories of data concerned and the access rights.

Subprocessing

tastee's subprocessors that process personal data (e.g. for hosting, sending emails or text messages, or payment processing) are carefully selected. They are bound by a data processing agreement to comply with the same data protection requirements as tastee. The list is published on our Subprocessors page.

Handling of data security breaches

In the event of a data security breach, a defined procedure applies: immediate containment, root cause analysis, prompt notification of the businesses concerned, documentation of the measures taken and, where required by law, notification of the authorities and information of the data subjects.

tastee is a product of Megaphone Software AG, Rue des Sablons 6, 3960 Sierre. Questions: hi@tastee.app