Security and Infrastructure Policy
This text explains the general security approach to technical security, system infrastructure and service continuity of the CXR App platform. CXR App is offered and operated by Visual Memory Works GmbH (“VMW”). It is your point of contact for sales, billing, payment processing and support.
The platform is a software service provided over the internet. Various technical and organizational measures are applied to protect users’ data and for the secure operation of the systems.
TECHNICAL SECURITY MEASURES
Technical measures such as the following may be applied in the platform’s infrastructure:
- firewalls and network protection systems to prevent unauthorized access
- secure connection protocols for data transmission
- restriction of access permissions and role-based authorization
- regular software updates and security patches
- monitoring of system and network traffic
ACCESS MANAGEMENT
Access permissions for the platform are restricted according to tasks and responsibilities. Access controls apply to personnel and service providers who access the systems; permissions may be reviewed regularly.
DATA SECURITY
Technical and organizational security measures are taken to protect personal data against unauthorized access, loss, alteration or disclosure. However, it should be noted that no system on the internet can offer absolute security.
INFRASTRUCTURE RESILIENCE
To ensure service continuity, the platform may be operated on scalable and redundant infrastructures. Different data centers, network providers and infrastructure services may be used for this purpose. These infrastructure components may be updated or replaced over time.
For the infrastructure in Germany, three servers and a separate backup or cloud environment with a takeover arrangement (failover) are planned; the migration is not yet complete. Specific takeover times or availability figures are not promised.
SECURITY AT EXTERNAL PROVIDERS
External service providers used in operating the platform also apply their own security measures. However, VMW has no direct influence on security incidents or technical disruptions in these providers’ infrastructure. Where service providers process personal data on behalf of VMW, this takes place on the basis of contracts pursuant to Art. 28 GDPR. Further information is provided in the document Third-Party Services, Data Processors and Sub-processors.
SECURITY INCIDENTS
In the event of possible security incidents or suspected personal data breaches, VMW carries out the necessary technical and organizational assessments and complies with the reporting and notification obligations under the GDPR (Art. 33 and 34 GDPR). Where VMW acts as a processor, it informs the responsible business in accordance with the data processing agreement.
USER OBLIGATIONS
Users are also responsible for the security of their own accounts. Using strong passwords, not sharing login credentials and the security of their own devices are the users’ responsibility.
Please direct security-related notices to Visual Memory Works GmbH, Elbestraße 10, 45768 Marl, Germany, e-mail: info@visualmemoryworks.de.
CHANGES
This text may be updated if the security practices or the infrastructure change. The current text applies from the day of its publication.