Your data, and only your data
No marketing — these are the measures as built into the platform. Every item on this page demonstrably exists in the code and is guarded by automated tests.
Data isolation at database level
Every organisation has a shielded data space via Row Level Security: the database itself refuses rows belonging to another organisation, even if application code were ever to miss a filter. Every table holding organisation data carries such a policy.
Per-action authorisation
Access always requires a verified user, organisation membership and the right role — enforced server-side. An automated scan visits every single route of the platform and guards that nothing is reachable without access control.
API keys out of reach
Keys for AI, payments and e-mail stay server-side and are never visible in the browser: once saved, a key is never shown again. Platform API keys are stored as a hash only.
Dayporto is built to WCAG 2.2 level AA and checked automatically with every release — read the accessibility statement.
In practice
Two-factor authentication (TOTP)
Mandatory for all administrator accounts; the secrets and recovery codes are stored encrypted.
Audit log with hash chain
Every action is logged in a SHA-256 hash chain: changing or deleting anything afterwards is mathematically provable.
Content Security Policy
Scripts only run with a per-request nonce; inline event handlers have been eliminated entirely and are blocked by the browser.
Encryption at rest
Sensitive fields are AES-encrypted, with per-organisation keys (envelope encryption) and support for rotation.
Encrypted backups + weekly restore drill
Daily backups, optionally AES-256-encrypted before storage; every week the latest backup is actually restored and verified.
Updates without interruption
New versions first start as a trial environment that only receives traffic once database and health checks pass; rolling back takes a single command.
GDPR built in
Full data export per customer or organisation, erasure and pseudonymisation — directly from the admin, including the right to be forgotten.
SIEM detection and rate limiting
Built-in detection rules (anomalous logins, bulk exports, privilege escalations) plus export to your own SIEM; sensitive endpoints are rate-limited.
ISO 27001 & NIS2 self-assessment
Built-in self-assessment against the ISO 27001 Annex A controls and NIS2 article 21, with evidence per control.
Cybersecurity across the chain (NIS2 / CRA)
Per installation firmware, default password, updates and end-of-life; per customer an IT/OT inventory for the NIS2 file; cyber legislation and the national contact point per country on the compliance dashboard — following the Euralarm/CoESS guideline 2026.
Legally covered
Data processing agreement, terms and conditions and privacy policy are public: data processing agreement · terms · privacy
Found a vulnerability?
Report it via our responsible disclosure page. Current availability is shown on the status page.