← Back to homepage
Technical and organizational measures
List of safeguards we apply when processing data in ConsentBoard. In line with Art. 32 GDPR and § 10 of our Data Processing Agreement (DPA). Updates to measures do not require a DPA amendment — this page is the source of truth.
Last updated · 2026-05-17
Hosting and data location
- Primary server infrastructure within the European Economic Area (Poland – OVH Warsaw; Germany – Hetzner – backups/overflow).
- Backups in a second independent data center.
- CDN delivering the static cmp.js script from EU PoPs (BunnyWay, Slovenia).
Transmission and encryption
- Forced HTTPS/TLS 1.3 on all public endpoints (HSTS preload, 1-year max-age).
- cmp.js, client panel, admin panel and consent / scanner APIs – TLS only.
- Session cookies flagged HttpOnly + Secure + SameSite=Lax where supported.
Access and authorization
- Admin panel gated by Google OAuth + per-account is_admin flag.
- Passwords stored as bcrypt (PHP password_hash, default cost). No plain text.
- User sessions: 64-char token cookie + cmp_user_sessions table with expires_at; rotation on renewal.
- Database access restricted to localhost socket (port 3306 not exposed).
- Audited admin action logs in cmp_config_audit and cmp_retention_changes.
Minimization and pseudonymization
- We do not store full visitor IP – only anon_hash (SHA-256 of IP fragment + UA + daily salt).
- We do not store names, emails, phones, national IDs, addresses, birth dates, biometrics or special category data (Art. 9 / 10 GDPR).
- Consent record scope limited to minimum: timestamp, action, consent categories, language, banner_version, User-Agent (diagnostics).
Configuration snapshots (proof of consent)
- Each banner_version generates an immutable configuration snapshot (cmp_banner_snapshots) — full vendor + cookie list at consent time.
- Snapshot linked to every consent entry (cmp_consents.banner_version → cmp_banner_snapshots).
- Forensic JSON available:
/cmp-panel.php?action=snapshot&id=X&v=N — for supervisory authority audits.
Retention and automated deletion
- Administrator picks per-site retention: 12 / 24 / 36 (default) / 60 months — § 7 DPA.
- Automated partition drop above global max (60 mc) — cmp_drop_old_partitions(), cron 03:00 UTC.
- Per-site DELETE for shorter retention — cmp_delete_per_site_retention(), cron 03:15 UTC, batches of 10 000.
- Backups retained max 90 days unless a longer period is justified by a security incident or legal obligation.
Attack protection and continuity
- WAF and DDoS protection via Cloudflare (optional — active for banner/cmp.js and selected clients).
- Rate limiting in cmp-consent.php and audyt-cookies.php (cmp_rate_limit table).
- CSP, X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy interest-cohort=().
- Uptime monitor every 5 min (worker/cmp/uptime-monitor.sh) with Rocket DM alert on DOWN/SLOW.
- Daily compliance scan per domain (worker/cmp/scanner.mjs) + email alert on new high-severity issues (worker/cmp/alert-issues.mjs).
- Pre-deploy Playwright test (worker/cmp/test-banner.mjs) blocks cmp.js deploy on regression.
- Auto-rollback cmp.js deploy (worker/cmp/deploy-cmp.sh) — 3-version rotation.
Organizational procedures
- Written confidentiality obligation for everyone with data access.
- Annual GDPR / dark patterns / incident response training.
- Written procedures for granting and revoking system access (per contractor / employee).
- Incident reporting procedure: notify Administrator within 48 h of detection (DPA § 16).
- Data protection point of contact: rodo@nprofit.pl · +48 537 559 119.
Transfers outside the EEA
- Primary infrastructure in the EEA — no routine transfers.
- Cloudflare (USA / EU global PoPs): SCC + EU-U.S. Data Privacy Framework + configuration limiting data scope.
- Anthropic PBC (USA, unknown cookie classification via LLM): SCC + DPF. We send only cookie names and vendor domains — never end-user personal data.