ImoAsistimoasist.euSign in
You are offline. Changes have not been sent or confirmed by the server. Reconnect and submit again.

Security and continuity

Public Back

ImoAsist security and continuity

Direct answer

Each association uses a separate ImoAsist instance. The application and primary data are hosted in Germania, and the external backup copy is stored in Romania.

Implemented controls

  • HTTPS and session cookies sent only over HTTPS in production
  • Argon2id passwords with transparent upgrades from legacy PBKDF2 hashes
  • mandatory MFA for administrators and optional MFA for every other role, enforced on web and mobile
  • persistent privacy-preserving limits for password, MFA, and reset attempts
  • revocable sessions with inactivity and maximum-duration expiry
  • optional OpenID Connect SSO with pre-provisioned immutable identities and provider logout
  • origin validation for browser forms; logout changes the session only through a protected POST request
  • forwarded client addresses are trusted only from explicitly configured reverse-proxy networks
  • anti-framing, MIME-sniffing, referrer, browser-sensor and secure-transport response policies
  • authentication and signed-in pages are marked no-store
  • role-based access for administrator, maintenance manager, dispatcher, technician, and viewer
  • access scopes by customer, site, and team; assets inherit their site's access
  • SHA-256 chained audit log with serialized PostgreSQL writes and an independently verifiable CSV export
  • authenticated-only media access and content validation for uploaded images
  • versioned database migrations, daily backup, integrity checks, and SHA-256 checksums
  • a separate external backup location and controlled per-customer restore

Continuity

  • target RPO: 24 hours
  • target RTO: 4 hours
  • backup retention: Conform politicii operationale de infrastructura, cu asociere clara pe client.
  • monitoring covers the application, database, certificate, disk space, worker queues, and age of the latest backup

Stored-data protection

Technical secrets use a separate encryption key for each instance. Each customer's database and files are isolated in their instance and are available only to authorized accounts. Storage-volume encryption depends on the selected hosting platform and must be confirmed for each deployment.

Limits and responsibilities

Availability, support, SLA exclusions, document retention, and deletion rights are set in the customer contract. A drawn signature captured in a report is not an advanced or qualified electronic signature.

Privacy · Security · Help Centre
Version dev Build unknown