Trust Center

Trust center: our commitment to security

Atalaya GRC is a regulatory compliance management platform built for regulated sectors (banking, insurance, energy, public sector, agri-food). Therefore, the security and protection of each customer’s data is the foundation the product is built on. This page summarises how we protect your information.

Multi-tenant architecture and data isolation

• Every record is tied to an immutable client identifier, set at login and never derived from user-controllable parameters.
• In addition, all data queries are filtered by the session’s client: one organisation cannot access another’s information.
• Isolation is also validated repeatably through a battery of multi-tenant integrity checks, plus internal penetration testing that includes cross-client access attempts.
• Likewise, file storage is segregated per client and direct URL access is denied: every file is served through the application after an ownership check.

Encryption

• In transit: all traffic travels over HTTPS/TLS, with HSTS set to one year including subdomains.
• At rest: integration secrets are also stored encrypted with AES-256-GCM, with the encryption key kept outside the web root.
• Credentials and tokens: passwords use strong hashing; in addition, API tokens are stored only as a SHA-256 fingerprint (the plaintext value is shown only once).

Access control

• Distinct roles (super administrator, per-client administrator, consultant, owner and auditor) with scoped permissions.
• In addition, session cookies with the Secure, HttpOnly and SameSite=Lax attributes.
• CSRF protection is also applied to every write operation.
• Moreover, each client can have its own administrator who manages their integration and API credentials with no access to other clients’ data.

Data protection and GDPR

• Platform hosted by Euronodes Ltd on servers in the European Union, under a data processing agreement (Art. 28 GDPR). Your data is hosted in the EU.
• Per-client segregation of data and files.
• Portability: each client can export a full dossier of their data and files (GDPR Art. 20 and DORA).
• Handling of GDPR data subject requests (DSAR) is also included.
• In addition, a queryable audit log of relevant actions.
• Sub-processors: Hosting provider in the European Union (Euronodes Ltd; its sub-processor Anthropic, in the United States, only for automated security analysis after incidents, under Standard Contractual Clauses) and Microsoft (encrypted backup of the platform in Microsoft 365 and, only for clients who enable the directory integration, Entra ID / Microsoft Graph).
• In addition, the hosting provider may analyse the server with automated AI agents (from Anthropic, in the US, under EU standard contractual clauses) only if it detects an attack or a critical failure: read-only commands on system state (processes, network connections and load, which include IP addresses) and an email notice for every action.

Regulatory coverage of the product

• DORA (digital operational resilience)
• NIS2 (cybersecurity)
• GDPR (data protection)
• EU AI Act
• ENS (Spanish National Security Framework)
• ISO/IEC 27001 (information security)
• ISO 22301 (business continuity)
• CRA (Cyber Resilience Act)
• Data Act (access to connected product data and switching provider)

Integrations

• Microsoft 365 / Entra ID: user synchronisation via Microsoft Graph, through an application registered and authorised by the client, with read-only permissions.
• Per-client REST API: also read-only, authenticated by Bearer token; it determines the client solely from the token (never from a parameter) and logs every access.

Continuity and resilience

• Daily encrypted backups of the whole platform: one on the server itself and a full copy off the server, in Microsoft 365.
• Audit log of platform actions.
• Also, internal business continuity (BIA) and operational resilience testing modules.
• In addition, an independent external penetration test is planned before the commercial launch.

Certification status in this trust center

• ISO/IEC 27001 (of the product itself): in progress. We are formalising the platform’s Information Security Management System.
• Meanwhile, Atalaya GRC already implements controls aligned with ISO 27001, DORA and NIS2 in its own operation.

Trust center security contact

Found a security issue or have questions about how we handle your data or about this trust center? Email us at seguridad@atalayagrc.com. We also treat security reports as a priority. In addition to federated sign-in (SSO with OpenID Connect and Microsoft Entra ID), Atalaya provides native two-factor authentication (2FA) via an authenticator app (TOTP), optional per user and with backup codes. The Microsoft Entra ID and Google Workspace integrations also enable automatic, periodic collection of identity evidence that feeds your compliance status and indicators. Finally, the optional AI assistant module, when licensed, uses a model hosted in the EU (Azure OpenAI), automatically removes identifiable personal data before each query and always operates with human oversight.