Technical and Organisational Measures

Practical safeguards implemented for the current UploadWerk service.

Access control

• Application data and temporary workflow storage are not exposed through public file paths.
• Workflow access is scoped to the current signed session; administrator routes use separate server-side authorization.

Authentication and administrator access

• Administrator access is restricted to administrator accounts and protected by multi-factor authentication in production.
• Passwords are hashed and session cookies are signed, HTTP-only and secure when the service is served over HTTPS.

Network and transport security

• Production traffic is terminated over HTTPS by the configured reverse proxy.
• The application sets restrictive browser security headers, validates the expected host and protects state-changing forms against CSRF.

Upload validation and malware protection

• Uploads are restricted by file extension, size and table-shape limits.
• The application validates file signatures and spreadsheet archive structure, rejects unsafe paths and formula-injection payloads, and requires malware scanning for public uploads.

Isolation and authorization

• Temporary workflow files use random internal references and are not served by predictable public URLs.
• Downloads are generated for the current workflow and returned with no-store headers.

Logging and monitoring

• Operational events record workflow names, steps, statuses, counts and request references rather than raw spreadsheet contents.
• Application, reverse-proxy and container logs support operational review. External uptime and error-monitoring alerts require operator configuration.

Data minimization

• Uploaded spreadsheet values are not intentionally copied into usage analytics or audit metadata.
• Contact messages are delivered through the configured SMTP service and are not stored in the application database.

Temporary storage and deletion

• Temporary workflow files become eligible for automatic deletion after 1 hour. The production cleanup service runs every 30 minutes.
• Operational metadata is automatically removed after 90 days unless it is needed for a specific security investigation or legal obligation.

Backup and recovery

• The production deployment creates daily compressed PostgreSQL backups, verifies their archive integrity and records a checksum.
• These backups cover PostgreSQL data. Temporary workflow files remain subject to their separate short retention period and must not be described as backed up unless the production configuration is changed accordingly.
• The configured backup rotation removes database backup files older than 14 days. Recovery procedures remain operator-managed, restore tests should be documented, and no guaranteed recovery time is stated.

Incident handling

• Operational checks and incident guidance are documented for the operator.
• Suspected security issues can be reported to the security contact listed in the Security page; response and notification decisions are handled case by case.

Confidentiality

• The service is currently founder-operated, and administrative access is limited to persons who need it to operate and secure UploadWerk.
• Customers should not include personal data in support messages unless it is necessary and authorized.

Provider and subprocessor management

• Providers are used only for hosting, email delivery, backups and optional error monitoring where configured.
• Material subprocessor changes will be communicated through the website or another appropriate channel.

Secure development and change management

• Source changes are version-controlled, checked by automated tests and deployed through a documented production process.
• Dependency, security and configuration checks are part of release verification. These controls are operated manually where automation is not configured.