Technical and Organisational Measures (TOMs)

Servers in AWS data centers in Frankfurt, Germany. Physical security measures — independently audited under SOC 2 and ISO/IEC 27001 — include controlled building perimeters with professional security staff on site 24/7, multi-factor authentication for authorized staff entering data center floors, comprehensive video surveillance and intrusion detection systems, strictly limited role-based and time-limited physical access granted on a need basis with all access logged and regularly reviewed, and no physical access for visitors or external parties to data center floors. The AWS Frankfurt Region is certified against ISO/IEC 27001, ISO/IEC 27017 and ISO/IEC 27018, audited under SOC 1, 2 and 3, and holds a C5 attestation (Cloud Computing Compliance Criteria Catalogue) issued under the standards of Germany’s Federal Office for Information Security (BSI).

TolaData has technical and organizational measures to control access to its premises and facilities, particularly to check authorization. These are: access only with key, key management (key issuance), visitors are accompanied by authorized employees, cabinets and offices are locked when not present.

Physical access media and credentials are issued only to authorized AWS employees and contractors with a legitimate business need, are time-limited, logged, and regularly reviewed and revoked when no longer required.

TolaData provides keys only to its employees; access to the office is only available to keyholders.

AWS does not permit routine visits to its data centers. Where third-party access is exceptionally required, it must be requested and approved in advance, is limited in scope and time, and such parties are escorted and monitored by authorized AWS personnel.

At the TolaData office, visitors are accompanied by authorized employees.

Passwords of TolaData users for accessing the TolaData application are both hashed and salted, and not stored as plain text.

At TolaData company, the policy on passwords and authorizations is based on the general provisions regarding the structure of passwords according to best practice (such as minimum length, and level of complexity). Furthermore, the company operates a ‘clean-desk policy’ when it comes to employee passwords and employees are required to use the company’s password manager.

Administrative access to the AWS environment (AWS console and APIs) is protected by individual named accounts, strong password requirements and mandatory multi-factor authentication (MFA).

Data transfer between the user and the TolaData application is encrypted using SSL/TLS (TLS 1.2 or higher); the same applies to every transmission between TolaData’s services and the AI sub-processor.

Data at rest in the AWS environment, including databases, storage volumes, automated backups, uploaded documents, document vector indexes and AI conversation history, is encrypted using industry-standard AES-256 encryption with keys managed in AWS Key Management Service (KMS).

TolaData’s engineering team administers the AWS environment through AWS IAM Identity Center with individual named accounts and MFA. The application runs as managed containers (Amazon ECS on AWS Fargate) in private subnets, and the production databases (Amazon RDS) sit in private database subnets that accept connections only from the application services, which authenticate with short-lived IAM tokens rather than static database passwords. For the production database (i.e. the database that holds data entered by clients), the access credentials are shared only with the authorised staff personnel for whom this is required.

Emails are generally transmitted by TolaData via TLS, provided that the recipient’s email provider supports TLS encryption. If required, emails can also be encrypted and signed using the S/MIME procedure. The IT policy of TolaData GmbH requires employees to encrypt sensitive and customer data on hard drives or external data carriers if storage is essential.

The TolaData software has role based access controls with users assigned different roles accessing different functionalities based on the access matrix. These users are authenticated on login based on their assigned roles.

For TolaData employees, specific access control rights are allocated to each role (involved in the processing of personal data) following the need-to-know principle. A Client Data Management Policy that governs access is in place.

In the TolaData Software, every client has one or more designated Org Admin users that manage invitations for new users and the deactivation of old users.

For TolaData company, an access control system is in place that allows creating, approving, reviewing and deleting employees’ user accounts and permissions. The use of common user accounts is avoided.

In the TolaData Software, Org Admins grant access permission to each project, and all its associated data, to users. This access can be edit access or view only. In addition, each project has one or more Project Admins who can grant access to other users to that specific project.

For TolaData employees, specific access control rights have been allocated following the need-to-know principle. A Client Data Management Policy that governs access is in place.

For the TolaData Software, Org Admin accounts are created and controlled by the TolaData User Support team at the request of the client or by the latter on their own. Project Admin accounts are managed by the Org Admin(s).

For TolaData company, privileged level accounts (including hosting-provider administrative accounts) are secured by mandatory MFA (where supported by the provider) and a password management system that consolidates all accounts in a centralized vault in a fully encrypted form.

Administrative access to and changes within the AWS environment are logged in a traceable manner (AWS CloudTrail); CloudTrail is protected against deactivation by an organisation-wide policy. Network traffic logs (VPC Flow Logs) and application logs are recorded in Amazon CloudWatch and retained for 90 days in the production environment.

For the TolaData software infrastructure, an access log (including attempted access) is kept both on server level and database level. A defined timeout is in place for sessions.

For TolaData employees, data access is logged in all systems used. Defined timeouts are required to be in place for all sessions.

TolaData’s AWS environment is logically isolated from other AWS customers using Amazon Virtual Private Cloud (VPC), private subnets, security groups and network access controls, ensuring that TolaData’s data remains isolated and does not get mixed with other customers’ data.

Furthermore, on our servers we maintain isolation control by separating the different environments (production, testing, development), with production and staging operated in separate AWS accounts (governed through AWS Control Tower), each with its own network and databases. Only authorised staff (where this is needed) have access to the production databases.

The TolaData application does not require the entering of personal data other than upon registration and login.

With the Terms of Use, TolaData and the client agree that the client alone is the controller of all (personal) data that the client processes through the Software. Data entered by clients can only be accessed in the software by users as assigned by the client’s organisation and permissions for the data of each project are set and managed by the client’s Admin users.

Ownership and legal responsibility for such data is always with the client. While TolaData cannot control (and thus be held liable) whether a client enters or uploads a file including personal information, we encourage best practices and pseudonymisation for personal data.

Only the minimum context required to answer an individual request is transmitted to the AI sub-processor: for document questions, a limited number of the client’s documents (or extracts) within a fixed context budget; for data questions, the database structure and a limited sample of result rows; for report generation, the evidence tables and answers retrieved for the report; at document upload, a short opening extract of the file. Internal identifier columns (id, *_id, uuid, guid) are removed from result data before transmission, and fixed volume limits apply to every request. These limits may be adjusted as the features are improved; the current values are available to clients on request. Document embedding, indexing and semantic search, as well as the execution of analytical queries, are performed within TolaData’s own hosting environment and are not transmitted. Authentication credentials and data of other clients are never transmitted.

Limitation: there is no automated detection or redaction of personal data in free-text fields or uploaded documents; clients are advised not to store beneficiary-level personal data in the TolaData Software and to curate the documents made available to the Knowledge Database.

Analytical queries generated by the AI features are restricted to read-only SELECT statements and are validated before execution; statements that would insert, update, delete or alter data, and known injection patterns, are rejected, and a row cap is enforced. Nothing produced by the AI features is written back to the client’s data automatically. Every figure in Data Analytics Assistant answers and generated reports is automatically compared with the data supplied to the model; a figure that cannot be traced causes the answer to be regenerated or blocks the report draft. Reports additionally undergo an independent check for evidence attributed to the wrong project or organisation, and Knowledge Database answers cite their source documents. All output is presented to the user as a draft for review, labelled as AI-generated; no AI output is published or transmitted onward automatically.

Every AI request is logged with a correlation identifier across all services involved (user, organisation, time, services called, query executed, duration); for the Data Analytics Assistant the generated SQL is stored against the conversation. Authentication secrets and tokens are excluded from logs. Conversations and generated reports are stored within the client’s own TolaData environment under the same access controls as all other client data; transient working state (paused conversations, workflow checkpoints) and unanswered background report jobs are deleted automatically by an hourly sweep: paused conversations and workflow checkpoints after 7 days, and unanswered background report jobs after 24 hours. When a user deletes a conversation, it is marked as deleted and excluded from all access; physical removal takes place on request.

All data transferred to and from the customer interface is encrypted in transit using SSL/TLS. A defined process is in place for the secure deletion of data from the hosting environment upon contract completion, and AWS applies audited media-destruction procedures for decommissioned storage devices.

The TolaData employees access the server and databases remotely and are required to not take local copies or use data carriers of client data. Furthermore employees are required to use only hardware and software that has been officially released by the company, not to print out any sensitive documents and not to forward information to external IT services.

Administrative access to and changes within the AWS environment are logged in a traceable manner (AWS CloudTrail); CloudTrail is protected against deactivation by an organisation-wide policy. Network traffic logs (VPC Flow Logs) and application logs are recorded in Amazon CloudWatch and retained for 90 days in the production environment.

For the TolaData software infrastructure, an access log (including attempted access) is kept both on server level and database level. The TolaData software automatically logs additions, edits and deletions of data by the user within the software.

For TolaData employees, access to data processing systems is only possible after login, no passing of passwords, a password policy is in place on how to proceed if a password becomes known, automatic logging when entering, changing and deleting data.

Application data is replicated across two physically separated Availability Zones (data centers) within the AWS Frankfurt (Germany) Region at any time. Data entered by clients is thus stored in two different data centers, ensuring non-loss of data even in case of a hazard at one Availability Zone.

Automated daily database backups are taken and stored in encrypted form. These backups enable the technical team to restore at a certain image point.

Isolation control is in place; different environments (production, testing) are run in separate AWS accounts. In case of an incident, daily backups can be restored within a few hours and a team is on standby ready to support the data restore and ensure services are reinstated swiftly.

AWS operates a documented incident response management program, aligned with ISO/IEC 27001 and audited under SOC 2, so that incidents affecting the underlying infrastructure are detected and addressed quickly.

At TolaData, an incident management plan is in place: Preparation and response measures are documented, including a list of necessary steps and a clear assignment of roles in the event of a data breach. Any incident or data breach must be reported immediately to management and the Data Protection Coordinator (Managing Director, Vijay Bhalaki). Where TolaData acts as processor, it notifies the affected customers (as controllers) without undue delay after becoming aware of a personal data breach and assists them with their notifications under Articles 33 and 34 GDPR (Clause 9 of the Data Processing Agreement). Where TolaData is itself the controller, the Data Protection Coordinator reports the breach to the competent supervisory authority within 72 hours where required and informs affected individuals where required.

The TolaData software and its hosting environment are monitored for intrusions: high and critical security findings (Amazon GuardDuty, AWS Security Hub) and network firewall alerts are sent immediately to the engineering team.

The AWS environment is protected by AWS Shield Standard, a continuously active managed DDoS protection service that constantly analyses traffic, recognises attacks early, and automatically mitigates malicious traffic before it reaches its target. In addition, AWS WAF (in blocking mode, with rate limiting) protects the application’s load balancer, and AWS Network Firewall applies stateful traffic filtering in the production environment.

Application data replicated across two separate Availability Zones within the AWS Frankfurt (Germany) Region at any time.

Automated daily database backups are taken and stored in encrypted form, enabling the technical team to restore at a certain image point.

TolaData takes all necessary measures to ensure that data processed on behalf of the customer are only processed in accordance with the customer’s instruction: TolaData processes the customer’s data only for purposes within the scope of the business relationship; all necessary contracts in accordance with GDPR are concluded.

Suppliers are carefully chosen and suppliers’ employees have only access to the information they need to carry out the order. Suppliers’ employees are obliged to comply with the data protection principles of GDPR. Control of the execution of the contract is warranted.

For the TolaData Software, application data is hosted and processed by Amazon Web Services EMEA SARL (38 Avenue John F. Kennedy, L-1855 Luxembourg) in the AWS Europe (Frankfurt) Region (eu-central-1) in Germany. A Data Processing Addendum pursuant to Art. 28 GDPR is concluded with AWS. The AWS DPA incorporates the EU Standard Contractual Clauses; TolaData additionally maintains a Transfer Impact Assessment and applies supplementary technical measures (encryption in transit and at rest, exclusive use of the Frankfurt Region). Where hosting in a different AWS Region has been agreed in writing with an individual client, the applicable hosting location and safeguards are set out in dedicated terms between the parties.

Where a client has enabled the optional AI features, natural-language generation is additionally performed by OpenAI (OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland) as sub-processor under a Data Processing Addendum pursuant to Art. 28 GDPR. Only the minimum context required to answer an individual user request is transmitted; document indexing, semantic search and query execution are performed within TolaData’s own hosting environment and are not transmitted. Client data is not used to train or improve any model. Inputs and outputs are retained by OpenAI for up to 30 days solely for abuse monitoring and are then deleted. Processing takes place in the United States on the basis of the EU Standard Contractual Clauses incorporated in the OpenAI Data Processing Addendum; TolaData maintains a Transfer Impact Assessment covering this engagement. The AI features are disabled by default and are enabled per organisation only at the client’s request. Details of the data transmitted are set out in Annex II of the TolaData Data Processing Agreement.

Product usage analytics for the TolaData Software is provided by PostHog, Inc. (2261 Market Street #4008, San Francisco, CA 94114, USA) via PostHog Cloud EU, hosted in Frankfurt, Germany, under a data processing agreement pursuant to Art. 28 GDPR incorporating the EU Standard Contractual Clauses. PostHog receives pseudonymous usage and device data of users only; content data entered into the TolaData Software is not intentionally collected or transmitted to PostHog as part of the product usage analytics.

For signing into the software via the company website as well as communication and support of customers, data is shared with a range of third-party data processors who can be found in our Data Privacy Policy: (https://www.toladata.com/terms-and-policies/).

Any third-party data processing takes place in compliance with Art. 28 GDPR, corresponding standards of the GDPR and, where applicable, the BDSG or other data protection laws and guidelines.