Where the data is
We run our systems on our own physical server in a data centre in Slovakia. We don't use public cloud platforms to store customer data.
For IT and security managers
Security and operations
Where your data is, how we protect it and what happens when something goes wrong. We only describe what we actually do today — we're happy to go through the details with your IT team in a meeting.
In brief
- 01Our own server in a data centre in Slovakia
- 02Encrypted backups every day, a second copy in Germany
- 03Access to our systems only with a login verified on the server
- 04Processor under Art. 28 GDPR
How we have it set up
Separate systems
Larger systems run in separate containers, and each application has its own database account that sees only its own data. Users see only what their role allows.
Backups
We back up every day, encrypted (AES-256), and keep a second copy off the server in a data centre in Germany. We keep 14 daily, 8 weekly, 12 monthly and 2 yearly backups.
Restore testing
We test restoring from backup. In the last test, in October 2026, the database was back in under a minute and the whole application within three minutes.
Encrypted connections
Our websites and systems communicate only over HTTPS (TLS 1.2 and 1.3). Our domains have HSTS preload, DNSSEC and a CAA record that allows only one certificate authority.
Access
No part of our systems can be reached without a login verified on the server. The server is administered only with SSH keys; password login is disabled. The client portal and our desktop applications support two-factor authentication.
Updates and monitoring
We apply security patches continuously and deal with critical vulnerabilities first. Automated monitoring watches services, scheduled jobs and backups, and alerts us straight away when something fails.
Protection against attacks
A firewall, blocking of repeated login attempts and strict security headers on our websites. We check security and quality in regular internal audits.
GDPR and contracts
For your company's data we are a processor under Art. 28 GDPR — we process it only under the contract and on your instructions. We don't sell, analyse or share your prices, margins, customers or contracts with anyone.
We keep server logs for 14 days, and messages from the contact form for no more than 12 months after the last communication.
If NIS2 applies to you
As your supplier, we'll describe our operations, backups and access arrangements when you assess us. Technical and organisational measures, the incident procedure and contacts go into an annex to the contract.
Found a vulnerability?
Write to us at info@brandforce.sk. The contact for security reports is also in our security.txt file under RFC 9116.
info@brandforce.sk · security.txt
This website
This website uses no cookies or visitor analytics and loads nothing from third-party servers.