Skip to content
Create a free account
Trust and openness

Data & security

Your customers’ digital assets are among the most sensitive things your company holds. We treat them accordingly.

Founded in Denmark
A Danish company, with support
European hosting
Database in Ireland, server in Germany
GDPR compliant
DPA and privacy policy
256-bit encryption
At rest and in transit
Architecture

Security in seven layers

Ejerblik is designed on the principle of defence in depth: independent security layers that back each other up. A single failure does not compromise the whole system.

1
Transport
All communication is encrypted with TLS 1.3. Invalid or outdated connections are rejected.
2
Authentication
Session-based JWT in HttpOnly cookies. Administrators are protected by mandatory two-factor authentication (TOTP).
3
Authorisation
Role-based access control. Only users with the right role can read, edit or delete data.
4
Data isolation
Database-level isolation ensures that no company’s data is available to another, neither through the API nor by direct query.
5
Secrets handling
All access keys and credentials are held solely in encrypted environment variables, never in the code or the repository.
6
Input validation
All user input is validated server-side on every API endpoint. Parameterised queries eliminate injection attacks.
7
Rate limiting
Automatic blocking after repeated failed login attempts per IP. Protects against brute-force attacks.
ejerblik.com
SikkerhedsstatusAlle lag aktive
✓L1Transport
✓L2Autentificering
✓L3Autorisation
✓L4Dataisolering
✓L5Secrets
✓L6Input-validering
✓L7Rate limiting

Live security status from the backend

Founded in Denmark
A Danish company, with support
European hosting
Ireland and Germany · EU processors
Infrastructure

European. No exceptions.

All data (assets, users, authentication, files) is stored with Supabase in Ireland. The application server sits with Hetzner in Nuremberg, Germany. Both primary providers are European and hold valid GDPR certifications.

Our AI assistant AInette uses a third-party supplier based outside the EU. API calls contain no customer-identifiable company data. This is documented in our privacy policy and our data processing agreement.

All primary data in the EU (Ireland)
Encryption at rest (AES-256) and in transit (TLS 1.3)
Automated backups with off-site replication
Every processor listed in our privacy policy
Anonymised analytics, no personally identifiable usage data
No resale of data to third parties
Access control

Least privilege, always

No user has access to data or features they do not explicitly need. Access rights are defined at individual and role level, and enforced at database level rather than only in the application.

Ejerblik offers four role levels: Owner, Editor, Contributor and Guest, with clearly differentiated read, write and administration rights.

ejerblik.com
Brugere · Hansen Teknik A/S
P
Peter Hansen
Ejer
S
Sara Nielsen
Redaktør
T
Bidragyder
E
Ekstern Revisor
Gæst

User roles in the Ejerblik platform

Database-level isolation
Row-level security is active on every table. No user can reach another company’s data, not even with direct database access.
Two-factor authentication (2FA)
Mandatory TOTP-based 2FA for all Ejerblik administrators. Platform users can switch on TOTP-based 2FA under Settings, and it is enforced at every login. Making it mandatory for owner accounts will be rolled out during 2026.
Cryptographic password hashing
Passwords are never stored in plain text. Hashing uses bcrypt (cost factor 12), the industry standard for password protection.
Automatic session expiry
Sessions expire automatically. Refresh tokens have a limited lifetime and can be revoked immediately if compromise is suspected.
Data protection

The GDPR is not a tick-box

We process personal data for the narrowest necessary purpose. Our DPA can be signed digitally and is drawn up in accordance with Article 28(3) of the GDPR.

The customer is the controller, Ejerblik is the processor
All data stored in the EU (Ireland)
Right to erasure: full deletion within 30 days
Breach notification within 48 hours
No profiling and no resale of customer data
Consent-based analytics, which you can turn on and off
The sub-processor list is published in the DPA
The AI assistant does not use customer-identifiable data
Network

Secure transport end to end

TLS 1.3
An encrypted connection on every endpoint. Older protocols are not supported.
HSTS
Browsers are forced onto HTTPS. No unencrypted connections are accepted.
X-Frame-Options
Clickjacking protection. Ejerblik cannot be embedded in someone else’s iframe.
Content-Type nosniff
MIME-type sniffing is disabled. This counters content-type-based attacks.
Referrer-Policy
Strict origin-when-cross-origin. Minimises the exposure of URL data.
Rate limiting
Automatic throttling after repeated failed login attempts. Blocking is IP-based.
Certifications & road map

We set the bar higher

The GDPR is the minimum standard. Our ambition is to document the security formally, for the sake of our customers and our partners.

GDPR complianceActive

The data processing agreement, cookie handling, the right to erasure and the breach notification flow are implemented and documented.

OWASP Top 10 mitigationActive

Our security architecture actively addresses the 10 most critical web security risks, from broken access control to injection and authentication failures.

ISO 27001 certificationPlanned for 2026

We are preparing for ISO 27001 certification through Vanta, and expect to be certified during 2026. ISO 27001 is the internationally recognised standard for information security management.

The D-sealUnder consideration

We are considering applying for the D-seal, the Danish labelling scheme for IT security and responsible use of data.

Responsible disclosure

Found a vulnerability?

We value responsible disclosure from security researchers and consultants. Contact us directly and we will acknowledge it within one working day.

[email protected]