Keeping your data safe

All customer data — the database, uploaded photos and documents, and the backups — is stored in the European Union, in the Czech data centre of Aruba Cloud (Aruba S.p.A.).

EHS Axis is developed and operated by Cyber in Systems Kft., a Hungarian company. No provider outside the EU stores workspace data (non-conformities, incidents, photos etc.), and we do not transfer it outside the EU. The only exception is card payment: Stripe may transfer billing contact data to the USA within its group under the EU–US Data Privacy Framework.

Every connection between your browser and our server is encrypted (TLS 1.2 and 1.3, HSTS); older, weak protocols are rejected.

Passwords are stored only as one-way salted hashes (bcrypt) — not even we can see them. Two-factor authentication secrets are stored encrypted with AES-256-GCM. Card details are handled by Stripe and never reach us.

Six roles (owner, administrator, approver, responsible, reporter, viewer) control who can see and change what.

Two-factor authentication (authenticator app + recovery codes) is available to every user, and the company owner can make it mandatory for administrators or for everyone. Accounts are temporarily locked after too many failed sign-in attempts, and changing a password signs out every other session.

The operator console uses a sign-in separate from customer accounts, is protected by two-factor authentication, and is accessible only to designated staff bound by confidentiality.

Each company's data is logically separated: every query is filtered to the company, and the company is always determined by the server, never by data sent from the browser. Automated tests check before every release that no company can see another's data.

Health data in incident records (injury, injured person's details) is visible within the company only to administrators and the designated investigator.

We check the type of uploaded files by their content (not their name), and size limits apply. Files can only be downloaded by members of the company, invoices only by administrators.

Photos are recompressed on upload and stripped of hidden metadata (EXIF), including GPS location.

The database and uploaded files are backed up daily and kept for 14 days; each day's backup is also copied to a separate server. Only the operator can access the backups.

We test restoring from backup automatically every week: we build a temporary database from the latest backup and verify the data and the referenced files.

Our commitments: at most 24 hours of data can be lost (RPO — since the last daily backup), and after a major failure we restore the service within 1 business day (RTO).

We target 99.5% monthly availability. The service is checked every 5 minutes from a separate server and we are alerted immediately if it goes down; a process manager restarts the application if it stops.

We deploy updates outside business hours where possible; they cause at most a few minutes of downtime.

Automated regression tests run before every release — including permission tests, cross-company isolation tests and security tests that simulate attacks. Our latest comprehensive security review was in October 2026; the issues found were fixed, and tests make sure they don't come back.

We update the libraries we use regularly and check them for known vulnerabilities. Strict security headers (content security policy, clickjacking protection) add protection in the browser.

We notify affected customers of a personal data breach without undue delay and at the latest within 48 hours, with the information required by Article 33 GDPR (what happened, who is affected, likely consequences, what we have done).

Server and application logs are kept for 30 days so that events can be investigated afterwards.

The company owner can download all of the company's data and files at any time, free of charge (JSON, Excel and the files in a ZIP) — switching providers is supported under the EU Data Act.

After a subscription ends, the data stays read-only and exportable for 90 days, then we delete it (it disappears from backups within a further 14 days).

We only use providers that are necessary for operation and process data in line with EU rules: hosting and backup, e-mail delivery, online payment, invoicing, and bot protection on public forms. The full, up-to-date list is in Annex 1 of the Data Processing Agreement; we notify you at least 30 days in advance before adding a new sub-processor.

If you find a security issue, please e-mail info@ehsaxis.com with the subject “Security” and don't disclose it publicly until we've fixed it. We will respond within 5 business days. Contact details are also available in machine-readable form at /.well-known/security.txt.