Annex 1 to the data processing agreement
Technical and organisational measures
Art. 8 revFADP requires a processor to document its protective measures. This page is the overview. It describes what is built, not what is planned.
- Place of processing
- Database and files in Switzerland, Zurich region. Application and mail via Vercel and Resend (USA)
- Disclosure abroad
- Processing by Vercel and Resend may take place in the USA. Contractual and transfer documentation is still being completed in the draft DPA.
- Encryption in transit
- TLS
- Encryption at rest
- AES-256
- Row level security in the database
- Tenant- and role-based database policies for personal data
- File storage
- Employee and applicant documents in private storage; public website assets are separate
- Audit log
- Exportable logs of supported security and HR actions
- Sub-processors
- Supabase for the database and file storage, Vercel for the application, Resend for email. The former Anthropic integration has been removed.
Nine protection goals
- Access control
- Authentication control
- Media and transmission control
- Input control
- Disclosure control
- Provider support access
- Deletion and retention
- Availability
- Detection and response
What the signed contract contains
The detail for each protection goal is Annex 1 to the signed contract. It names the tests that back every assurance and is meant for your data protection officer's records.
What this annex does not cover
It describes the data Rewalz processes ON BEHALF of a company. For waiting list applications, support requests and the profiles of private individuals in the job market, Rewalz is the controller itself; the privacy statement covers those.