Information security

This is an English translation provided for convenience. The Romanian version is the legally binding text.

This page describes the security level of the City Twin platform and the measures applied, for IT departments assessing the platform. It is written in terms of measures and processes, not configurations: implementation details are discussed under a confidentiality agreement, within the contractual framework.

The distinction that matters throughout this page: the urban model is designed for non-personal data and public documents, not for named records; the platform and account administration nevertheless process technical data, accounts, contact details and logs, in the situations described in the privacy policy.

1. The measures applied

We apply technical and organisational measures adapted to the risks of the platform. Implementation details and documentation intended for institutional assessments are made available within the contractual framework.

Encrypted communication between browser and server (HTTPS/TLS), on all pages and all calls.
Access control to the platform's systems and data, based on roles and least privilege.
Vulnerability management: software components are monitored for security alerts, and these are handled according to their severity.
Abuse limitation: caps on the number of requests and on costly operations, as protection against resource exhaustion.
Service monitoring and an indication in the interface when a feature is running in degraded mode.
Backups of the platform's data, with tested restoration.
A designated Data Protection Officer, with a public contact ([email protected]).

Security incidents are handled according to a documented plan. Breaches involving personal data are notified to the supervisory authority and, where applicable, to the data subjects, within the time limits laid down by law; for a City Twin space dedicated to an institution, we notify the controller without undue delay. The real-time operating status is public: Platform status.

2. Reporting a vulnerability

We have a coordinated disclosure policy. If you discover a vulnerability, write to us using the contact details in security.txt or at [email protected].

We undertake to: acknowledge receipt, investigate, keep you informed and not take legal action against researchers who report in good faith, without copying, extracting or transmitting data outside the authorised environment and without degrading the service. What we ask of you: to allow us a reasonable period for remediation before publication.

3. Data and continuity

The city model is exported in open formats with a public schema, under the conditions laid down by contract and in compliance with the licences of the sources used. When a contract ends, the data is handed over or deleted, at the institution's choice. The data can be exported in open formats, which reduces the institution's dependence on the platform for access to its own data; the details are on Data licences.

4. Documentation for institutions

The contractual documentation on security and data protection, including the data processing agreement (Art. 28 GDPR), is made available to client institutions on request, via [email protected].

5. What we do not claim

We do not hold an ISO 27001 certification and we do not claim one. Alignment with NIS2 is voluntary: we apply the measures relevant to a provider to the public sector, without claiming to have obtained a formal attestation. We prefer to state exactly what we have, rather than give the impression of a compliance we have not demonstrated through an external audit.

6. Reference framework

Art. 32 GDPR (technical and organisational measures appropriate to the risk) · Directive (EU) 2022/2555 (NIS2) and the Romanian transposing legislation · Law No. 190/2018 (on measures implementing the GDPR in Romania).