技术和组织安全措施 (TOM) — Sustalium
Document Ref: TOMS-2026-V1.4 · Last updated: 2026 年 8 月 31 日
Sustalium B.V. has implemented and will maintain the following technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR.
访问控制
Access to systems and data is restricted to authorized personnel based on the principle of least privilege. Multi-factor authentication is required for access to critical systems.
加密
All Customer Data is encrypted in transit using TLS 1.2 or higher. All Customer Data is encrypted at rest using industry-standard AES-256 encryption.
数据最小化
公司仅收集和处理提供服务所需的个人数据。
记录和监控
The Company maintains detailed logs of access to critical systems and monitors for suspicious activity. Furthermore, the platform maintains an immutable, cryptographically-verifiable audit trail of all critical customer data events (such as data submission and report generation) to support customer compliance and audit requirements.
事件响应
The Company maintains a formal Incident Response Plan to identify, manage, and remediate security incidents in a timely manner.
人员安全
All personnel with access to Personal Data are subject to confidentiality obligations and undergo regular security and data protection training.
业务连续性
The Company maintains a Business Continuity and Disaster Recovery plan, including regular backups of Customer Data, to ensure the availability of the Services.
问题？ Contact us through our 联系页面 for any questions about our security measures.