Security

We protect your data through multiple layers of defense, industry best practices, and continuous monitoring.

Application Security

OWASP Top 10 Compliance

We implement protections against the OWASP Top 10 security risks, including:

• Injection attacks (SQL injection, command injection, etc.)
• Broken authentication and session management
• Cross-site scripting (XSS)
• Insecure direct object references
• Security misconfigurations
• Sensitive data exposure
• Missing function level access control
• Cross-site request forgery (CSRF)
• Using components with known vulnerabilities
• Unvalidated redirects and forwards

Secure Development Practices

• Regular security code reviews and static analysis
• Vulnerability scanning and penetration testing
• Secure coding standards and training
• Dependency management and vulnerability tracking

Infrastructure Security

Defense in Depth

Our infrastructure uses multiple security layers to protect against threats.

A web application firewall (WAF) guards against common web attacks and exploits, with real-time threat detection, bot protection, rate limiting, and custom rules for application-specific threats.

At the network level, we enforce isolation and segmentation, least privilege access controls, and intrusion detection and prevention systems. We run regular security assessments and monitoring across the stack.

For containers, we use secure base images with runtime protection, vulnerability scanning, resource limits, and regular patching.

Data Protection

Tenant isolation

Each customer's data lives in its own database. Users, groups, workflows, and the audit log for your tenant are stored separately from every other tenant's.

Encryption

On top of storage-level protection, the secrets you hand us are encrypted again by the application with AES-256, under a master key that is kept outside the database:

Profile photos waiting to be uploaded to Entra ID are stored encrypted too, and deleted once delivered. A safety net removes any left behind after 30 days.

All data in transit is protected with TLS encryption. This covers API communications, certificate management, and end-to-end encryption for sensitive operations.

Passwords and sign-in tokens

Portal passwords are never stored. We keep a bcrypt hash with a cost factor of 12. Password reset tokens and magic sign-in link tokens are stored only as SHA-256 hashes, and reset tokens expire after 24 hours.

Active Directory agent

The on-premises agent only makes outbound HTTPS calls, so you open no inbound ports. Each agent has its own API key, signing secret, and encryption key. Adcyma stores the API key as a bcrypt hash for checking it, alongside an encrypted copy so the personalized installer can be rebuilt.

• Commands to the agent are encrypted with AES-256-GCM under that agent's own key before they're queued.
• Requests from the agent are signed with HMAC-SHA256. The signature covers a timestamp, the HTTP method, a SHA-256 hash of the body, and a one-time nonce.
• Stale requests are refused. A signed request more than five minutes off is rejected.
• Replays are refused. Each nonce works once, so a captured request can't be sent again inside the window.
• Your AD service-account password stays on your server. It's entered in the installer and is never sent to Adcyma.
• Agent updates must be code-signed by Adcyma. The updater refuses anything else.

Adcyma support can rotate an agent's keys, which immediately invalidates the running agent until it's reinstalled, or revoke an agent permanently. See Managing the Active Directory Agent for how this works day to day.

Audit log

Every tenant has an audit log, shown under Administration → Logs. Each entry records when it happened, its severity, which part of the product it came from, what happened, and the user or API key behind it where there is one. Audit log entries aren't expired automatically.

Data Residency and Privacy

Adcyma is built and run in Sweden, and all data is hosted in Germany and stays within the EU. Our infrastructure runs with an EU-owned and operated provider headquartered in Germany, with no corporate ties to non-EU jurisdictions. Its data centers are ISO 27001-certified with strict physical and logical access controls.

This means we are not subject to the US CLOUD Act, FISA, or similar non-EU legislation. We maintain full GDPR compliance, practice data minimization (we only collect and store what is necessary), and support complete data removal on request.

Access Controls

Authentication & Authorization

• Multi-factor authentication (MFA) support
• Role-based access control (RBAC)
• Principle of least privilege
• Regular access reviews and audits

Administrative Security

• Secure administrative access procedures
• Audit logging for all administrative actions
• Separation of duties for critical operations
• Regular credential rotation and management

To flag separation-of-duties conflicts between groups in your own tenant, see SoD Rules.

Monitoring & Incident Response

Continuous Monitoring

• 24/7 security monitoring and alerting
• Automated threat detection and response
• Regular security metrics and reporting
• Performance and availability monitoring

Incident Response

• Dedicated incident response procedures
• Rapid containment and remediation capabilities
• Post-incident analysis and improvement
• Communication protocols for security events

Cloud Security

Operations

Experienced cloud engineers maintain our security posture, covering cloud security architecture, threat modeling and risk assessment, security automation, and compliance requirements. We apply regular security updates across all managed services.

Compliance & Standards

Industry Standards

We align our security practices with recognized industry frameworks:

• ISO 27001 security management principles
• OWASP secure development guidelines
• NIST cybersecurity framework
• EU GDPR privacy and data protection compliance

Regular Assessments

• Periodic security audits and assessments
• Vulnerability scanning and penetration testing
• Compliance reviews and gap analysis
• Third-party security validations

Transparency and Communication

We share security updates regularly, follow clear incident notification procedures, and welcome open dialogue about our security practices. We improve continuously based on feedback.