# Security & GDPR Source: https://ordergroup.co/company/security/ Last updated: 2026-10-12 > How Order Group protects your data and code as a GDPR processor: a DPA per project, access control, where data lives, 24-hour incident notice, code ownership. # Security and data protection at Order Group Since 2013 we have delivered 160+ software projects in 15+ industries, including energy, fintech and IoT companies. Their compliance teams ask the same questions before they sign: who sees our data, where does it live, what happens when something goes wrong, who owns the code. What you'll find below - Our role under GDPR - Where your data lives - Who gets access - How we protect systems - When something goes wrong - You own the code - Documents on request [Request security documents](https://ordergroup.co/contact-us/) ![Order Group team photo outdoors in matching black branded t-shirts](https://ordergroup.co/media/images/cover_company_about_us_1x.format-webp.width-1600.webp) ## Our role under GDPR: data processor and DPA When we build or maintain a system that holds personal data, you are the controller and we are the processor. We process personal data only on your documented instructions and never for our own purposes. For each project we sign a separate data processing agreement (DPA). It starts from our template based on Article 28(3) GDPR and is filled in for the actual work: the scope of services, the categories of data and data subjects, and the security measures that apply. Each project also gets an entry in our record of categories of processing activities, as Article 30(2) GDPR requires. It lists the categories of data and data subjects, the security measures, where processing takes place and any subprocessors. Our data protection policy and procedures are approved and signed by the management board. They cover authorisations and access rights, personal data breaches, privacy by design and by default, risk assessment and DPIA, retention and deletion, data subject rights and relations with suppliers. We review the procedures at least once every 12 months. ## Where your data lives ### Production: your cloud account In most projects, production runs in your own cloud account, for example AWS, in the EU region you choose. You are the party to the contract with the cloud provider, so the provider is not our subprocessor. We get access to that environment to do our work. Your production data is not copied to our servers. ![Data centre hall with rows of server cabinets and overhead cable trays](https://ordergroup.co/media/images/photo-1564457461758-8ff96e439e83.format-webp.width-1200.webp) ### Test environments: Poland The test environments we host ourselves run on servers in Poland. Processing takes place in the European Economic Area. Data goes outside the EEA only if you, as the controller, decide that it should. As the processor, we do not make that decision. ![Smartphone with a padlock security screen on a desk (Unsplash, Dan Nelson)](https://ordergroup.co/media/images/photo-1584433144859-1fc3ab64a957.format-webp.width-1200.webp) ![Data centre hall with rows of server cabinets and overhead cable trays](https://ordergroup.co/media/images/photo-1564457461758-8ff96e439e83.format-webp.width-1800.webp) ![Smartphone with a padlock security screen on a desk (Unsplash, Dan Nelson)](https://ordergroup.co/media/images/photo-1584433144859-1fc3ab64a957.format-webp.width-1800.webp) ## Who gets access, and for how long ### Named accounts only Everyone on your project has their own account. Access to cloud infrastructure goes through roles (AWS IAM Identity Center), following the principle of least privilege. Shared accounts are not allowed unless there is a technical reason for them. ### Approved requests and authorisations Permissions are granted on a request approved by the head of the relevant department, and nobody processes personal data without a written or electronic authorisation. Temporary access has an expiry date. We keep a register of authorised people. ### Multi-factor authentication Applied according to the role and the risk. ### Access ends with the role When someone leaves the team, their accounts are removed without delay. We also review periodically who has access to project infrastructure. ### Confidentiality without an end date Everyone authorised to process data is bound by confidentiality that continues after the contract ends. ## How we protect systems We protect systems at the network, application and workstation level. ### Network and traffic - Servers and databases are not exposed to the public internet. They are reachable only through a load balancer or a VPN, behind firewall rules. - TLS is enforced for all traffic that leaves the internal server network. - Where a project needs it, the application sits behind the Cloudflare proxy for DDoS protection and traffic filtering, and all traffic from the internet goes through Cloudflare. ### Backups and logs - Databases are backed up automatically. A typical setup is a full daily backup kept for 14 days. The exact parameters depend on the project: in one project, for example, we run a weekly backup kept for 28 days. - Application logs are typically kept for 30 days, though in some projects they rotate by available disk space instead. Our error tracking removes sensitive values such as card numbers and credentials from logs by default. ### Workstations Computers used for client work have disk encryption managed centrally by our system administrator, plus endpoint protection, a firewall and current updates. Client data does not go to private email accounts or messengers without approval. ## Privacy by design, in practice ### Separate environments Separate development, test and production environments. ### Test data Test data anonymised or pseudonymised, depending on what the project allows. ### Role-based access Role-based access inside the application, with administrative and operational functions kept apart. ### Optional processing off Optional processing, such as profiling or marketing, switched off by default. ### Only the fields needed Only the fields the purpose needs. ### A real-world example Users verify their identity with a document scan and a national ID number, and confirm income through their bank. Screens with sensitive data are masked in analytics and session recordings, so the national ID number and card number never reach external tools, and analytics starts only after the user consents. ## When something goes wrong Everyone on our team must report a suspected breach internally without delay. We then secure the evidence (logs, configuration), assess the risk and record the event. We record every incident and every suspicion. When we act as your processor, our standard DPA commits us to inform you without undue delay and no later than 24 hours after we become aware of the incident. That is stricter than the GDPR wording and leaves you time to meet your own 72-hour deadline towards the supervisory authority. ![Shield icon representing security and reliability](https://ordergroup.co/media/images/security_reliability_1x.format-webp.width-2880.webp) Report internally without delay Secure evidence and assess the risk Inform you within 24 hours ## Our commitments at a glance The deadlines and retention periods from this page in one place. Backup and log periods depend on the project. | Commitment | Our standard | |---|---| | Incident notice to you | Within 24 hours of becoming aware (standard DPA) | | Help during a supervisory inspection | Within 2 business days | | Delete or return your data after the contract ends | Within 10 business days | | Written confirmation of deletion or return | Within 7 business days after that | | Database backups | Typically daily, kept for 14 days (varies by project) | | Application logs | Typically kept for 30 days (varies by project) | | Review of our procedures | At least every 12 months | ## Audits and the end of the project ### Audits and inspections Our DPA gives you the right to audit and inspect how we process your data. If a supervisory authority inspects you, we help with the information you need within 2 business days. ### When the project ends Within 10 business days after the main contract ends, we delete or return your data, including copies. The choice is yours. Within 7 business days after that we confirm it in writing. Backups are deleted when their retention cycle ends. ## You own the code ### Economic rights pass to you with each payment The economic rights to the code pass to you with each payment, for the fields of use set out in the contract. You do not wait until the end of the project to own what you have paid for, and you get the source code. The working repository stays in our controlled environment, where only people on your project have access. ![Business meeting in a glass-walled conference room](https://ordergroup.co/media/images/cover_services_consulting_discov.format-webp.width-1200.webp) ![Business meeting in a glass-walled conference room](https://ordergroup.co/media/images/cover_services_consulting_discov.format-webp.width-1800.webp) ## SLA, hypercare and documents [SLA and hypercare We agree the SLA with each client and write it into the contract. After go-live, we can provide hypercare. We agree its scope and length with you before launch.](https://ordergroup.co/company/about-us/our-approach/) [Documents on request Your security or procurement team can ask us for a DPA drafted for your project, a description of the technical and organisational measures we apply, and answers to your security questionnaire. Write to hello@ordergroup.co and we will send what you need.](mailto:hello@ordergroup.co) [Case studies See our case studies from regulated industries.](https://ordergroup.co/case-studies/) Founded **2013** The year five co-founders registered the company and started taking on client work together. Projects delivered **160+** Software projects shipped for clients since 2013. Industries served **15+** From energy and fintech to healthcare and industrial IoT. Clutch rating **5.0** Clutch rating from 18 verified client reviews. ## Why work with us: what you get Your data stays in your cloud account, you get a DPA per project and 24-hour incident notice, and the code is yours. [Request security documents](https://ordergroup.co/contact-us/) ![Two people in the foreground, black dry-erase board with colorful sticky notes visible in the background.](https://ordergroup.co/media/images/workshop_photo.2e16d0ba.format-webp.fill-2880x1620.webp) ## Security questions we get from procurement teams ![Business meeting in a glass-walled conference room](https://ordergroup.co/media/images/tumbnail_services_consulting_discovery_1x_P.format-webp.webp) [Request security documents](https://ordergroup.co/contact-us/) ### Are you a data processor or a controller? For the systems we build and maintain for you, we are a processor and you are the controller. We process personal data only on your documented instructions and never for our own purposes. ### Where is our data stored? Production usually runs in your own cloud account, in the EU region you choose. Test environments we host ourselves are on servers in Poland. Processing takes place in the EEA, and data leaves it only if you decide it should. ### How fast will you tell us about an incident? Without undue delay and no later than 24 hours after we become aware of it, so you can meet your 72-hour deadline towards the supervisory authority. ### Who owns the source code? You do. The economic rights to the code pass to you with each payment, for the fields of use set out in the contract, and we hand over the source code. ### What happens to our data when the contract ends? Within 10 business days we delete or return your data, including copies, as you choose. Within 7 business days after that we confirm it in writing. Backups are deleted when their retention cycle ends. ### Do you sign a separate DPA for each project? Yes. Each project has its own DPA and its own entry in our record of categories of processing activities.