Skip to content
Emily Helps Docs

Data Security Measures

Introduction

Section titled “Introduction”

Article 32 of the GDPR requires organizations to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Emily Helps implements comprehensive security measures and provides tools to help you maintain data security.

Security Requirements

Section titled “Security Requirements”

Risk-Based Approach

Section titled “Risk-Based Approach”

Security measures must be:

  • Appropriate to the Risk: Proportionate to the likelihood and severity of risks
  • State of the Art: Use current best practices and technologies
  • Cost Effective: Balance security with implementation costs
  • Regularly Reviewed: Continuously assess and improve

Key Considerations

Section titled “Key Considerations”
  • Nature of personal data (especially special categories)
  • Volume of data processing
  • Impact of potential breach
  • Likelihood of security incidents
  • Available security technologies
  • Implementation costs

Technical Security Measures

Section titled “Technical Security Measures”

1. Encryption

Section titled “1. Encryption”

Data in Transit:

  • TLS 1.2 or higher for all connections
  • HTTPS enforced for all web traffic
  • Encrypted email communications where appropriate
  • VPN for remote access
  • Secure file transfer protocols (SFTP, HTTPS)

Data at Rest:

  • Database encryption (AES-256)
  • File system encryption
  • Encrypted backups
  • Encryption key management
  • Hardware security modules (HSMs) for key storage

Emily Helps Implementation:

  • End-to-end encryption for sensitive data
  • Automatic encryption of backups
  • Secure key rotation
  • Certificate management

2. Access Controls

Section titled “2. Access Controls”

Authentication:

  • Strong password requirements
  • Multi-factor authentication (MFA)
  • Account lockout after failed attempts
  • Password expiration policies
  • Single sign-on (SSO) integration

Authorization:

  • Role-based access control (RBAC)
  • Principle of least privilege
  • Granular permission system
  • Segregation of duties
  • Regular access reviews

Emily Helps Features:

  • Customizable user roles
  • Permission templates
  • Access request workflows
  • Automated access reviews
  • Session management and timeout

3. Network Security

Section titled “3. Network Security”

Perimeter Security:

  • Firewalls and intrusion detection
  • DDoS protection
  • IP whitelisting where appropriate
  • Network segmentation
  • DMZ for public-facing services

Infrastructure:

  • Regular security patching
  • Vulnerability scanning
  • Penetration testing
  • Security information and event management (SIEM)
  • Intrusion prevention systems

Emily Helps Infrastructure:

  • Hosted on secure, certified infrastructure (Hetzner, Germany)
  • Regular security audits
  • Continuous monitoring
  • Automatic security updates

4. Data Minimization

Section titled “4. Data Minimization”

Technical Implementation:

  • Automated data deletion
  • Anonymization tools
  • Pseudonymization where appropriate
  • Field-level access controls
  • Data masking for testing environments

Emily Helps Features:

  • Configurable retention policies
  • Automated data lifecycle management
  • Safe test data generation
  • Data minimization by default

5. Backup and Recovery

Section titled “5. Backup and Recovery”

Backup Strategy:

  • Daily automated backups
  • Encrypted backup storage
  • Off-site backup replication
  • Regular backup testing
  • Documented recovery procedures

Recovery Capabilities:

  • Point-in-time recovery
  • Granular restoration options
  • Disaster recovery plan
  • Business continuity procedures
  • Recovery time objectives (RTO) and recovery point objectives (RPO)

Emily Helps Implementation:

  • Automated daily backups
  • 30-day backup retention
  • Encrypted backup storage in Nuremberg, Germany
  • Regular recovery testing
  • Self-service restore for certain data types

6. Monitoring and Logging

Section titled “6. Monitoring and Logging”

Audit Logging:

  • User activity logs
  • Data access logs
  • System event logs
  • Authentication logs
  • Administrative action logs

Monitoring:

  • Real-time security monitoring
  • Anomaly detection
  • Alert systems
  • Performance monitoring
  • Compliance monitoring

Log Management:

  • Secure log storage
  • Log retention policies
  • Log integrity protection
  • Regular log review
  • SIEM integration

Emily Helps Features:

  • Comprehensive audit trail
  • Customizable alerts
  • Compliance reporting
  • User activity dashboards
  • Automated anomaly detection

7. Secure Development

Section titled “7. Secure Development”

Development Practices:

  • Secure coding standards
  • Code review processes
  • Security testing in CI/CD
  • Dependency vulnerability scanning
  • Static and dynamic analysis

Deployment:

  • Secure configuration management
  • Infrastructure as code
  • Change management procedures
  • Rollback capabilities
  • Staging environment testing

Emily Helps Commitment:

  • Regular security assessments
  • Penetration testing
  • Bug bounty program
  • Responsible disclosure policy
  • Security-first development culture

Organizational Security Measures

Section titled “Organizational Security Measures”

1. Policies and Procedures

Section titled “1. Policies and Procedures”

Required Documentation:

  • Information security policy
  • Data protection policy
  • Acceptable use policy
  • Incident response plan
  • Business continuity plan
  • Disaster recovery plan

Policy Content:

  • Roles and responsibilities
  • Security standards
  • Incident procedures
  • Compliance requirements
  • Review and update procedures

2. Training and Awareness

Section titled “2. Training and Awareness”

Staff Training:

  • Data protection awareness
  • Security best practices
  • Phishing awareness
  • Incident reporting
  • Regular refresher training

Training Topics:

  • GDPR principles and requirements
  • Data handling procedures
  • Password security
  • Social engineering awareness
  • Physical security
  • Reporting obligations

Emily Helps Resources:

  • User training materials
  • Security best practice guides
  • Video tutorials
  • Regular security tips
  • Compliance checklists

3. Vendor Management

Section titled “3. Vendor Management”

Third-Party Risk:

  • Vendor security assessments
  • Data processing agreements
  • Regular vendor reviews
  • Compliance verification
  • Contract security terms

Vendor Requirements:

  • GDPR compliance
  • Security certifications
  • Incident notification
  • Audit rights
  • Data return or deletion procedures

4. Physical Security

Section titled “4. Physical Security”

Facility Security:

  • Access control systems
  • Visitor management
  • CCTV monitoring
  • Secure document disposal
  • Clean desk policy

Device Security:

  • Device encryption
  • Remote wipe capability
  • Lost/stolen device procedures
  • Secure disposal of hardware
  • Asset management

5. Incident Response

Section titled “5. Incident Response”

Incident Management:

  • Incident detection
  • Incident classification
  • Escalation procedures
  • Containment and recovery
  • Post-incident review

Documentation:

  • Incident logs
  • Response actions
  • Notification records
  • Lessons learned
  • Process improvements

See: Data Breach Management

Security Standards and Certifications

Section titled “Security Standards and Certifications”

Industry Standards

Section titled “Industry Standards”

Emily Helps aligns with:

  • ISO/IEC 27001: Information security management
  • ISO/IEC 27002: Security controls
  • ISO/IEC 27701: Privacy information management
  • NIST Framework: Cybersecurity framework
  • CIS Controls: Critical security controls

Hosting and Infrastructure

Section titled “Hosting and Infrastructure”

Hetzner Certifications:

  • ISO/IEC 27001 certified
  • ISO/IEC 27018 (cloud privacy)
  • TÜV-certified data centers
  • EU-based infrastructure
  • GDPR-compliant hosting

Regular Assessments

Section titled “Regular Assessments”
  • Annual penetration testing
  • Quarterly vulnerability scans
  • Regular security audits
  • Compliance assessments
  • Third-party security reviews

Your Responsibilities

Section titled “Your Responsibilities”

As Data Controller

Section titled “As Data Controller”

  1. Configure Security Settings:

    • Enable multi-factor authentication
    • Set appropriate password policies
    • Configure access controls
    • Enable audit logging

  2. Manage User Access:

    • Grant minimum necessary permissions
    • Review access regularly
    • Disable accounts promptly
    • Monitor user activity

  3. Train Your Team:

    • Provide security awareness training
    • Establish security procedures
    • Communicate security policies
    • Conduct regular refreshers

  4. Monitor and Review:

    • Review audit logs
    • Investigate anomalies
    • Update security measures
    • Test incident procedures

  5. Report Incidents:

    • Identify security incidents promptly
    • Report to Emily Helps support
    • Document incidents
    • Notify affected individuals if required

Security Checklist

Section titled “Security Checklist”
  • MFA enabled for all users
  • Strong password policy configured
  • User roles and permissions reviewed
  • Staff security training completed
  • Audit logging enabled
  • Regular log reviews scheduled
  • Incident response plan documented
  • Backup recovery tested
  • Data processing agreements in place
  • Physical security measures implemented
  • Device encryption enabled
  • Vendor security assessed
  • Security policies documented
  • Business continuity plan prepared

Security Monitoring

Section titled “Security Monitoring”

What to Monitor

Section titled “What to Monitor”
  • Failed login attempts
  • Unusual access patterns
  • Mass data exports
  • Permission changes
  • User account changes
  • Configuration changes
  • System errors and warnings
  • Performance anomalies

Alert Configuration

Section titled “Alert Configuration”

Set up alerts for:

  • Multiple failed logins
  • Access from unusual locations
  • Large data exports
  • Permission escalations
  • System configuration changes
  • Security policy violations

Emily Helps Monitoring

Section titled “Emily Helps Monitoring”
  • Real-time security monitoring
  • Automatic anomaly detection
  • Customizable alert rules
  • Security dashboards
  • Compliance reporting

Continuous Improvement

Section titled “Continuous Improvement”

Regular Reviews

Section titled “Regular Reviews”
  • Quarterly security reviews
  • Annual security assessments
  • Post-incident reviews
  • Technology updates
  • Threat landscape monitoring

Security Updates

Section titled “Security Updates”
  • Apply security patches promptly
  • Update security procedures
  • Refresh training materials
  • Review and update policies
  • Implement new security technologies

Emerging Threats

Section titled “Emerging Threats”

Stay informed about:

  • New vulnerabilities
  • Attack techniques
  • Security advisories
  • Industry best practices
  • Regulatory changes
Section titled “Related Documentation”

Further Reading

Section titled “Further Reading”
  • ICO Guide to Security
  • ENISA Security Measures
  • NIST Cybersecurity Framework
  • CIS Critical Security Controls
  • ISO/IEC 27001 Standards

Last updated: October 2025