XPmetric

DPA Annex II

Technical and Organisational Measures

Art. 32 GDPR · Last updated: 6 October 2026

This page summarises the technical and organisational measures XPmetric applies when processing personal data. It forms Annex II of the Data Processing Agreement. This summary is based on the documented implementation and operator controls. No ISO, SOC or other certification is claimed.

1. Pseudonymisation and encryption

  • Visitor identity (default cookieless mode): a daily-rotating salted hash (sha256(salt + siteId + IP + user agent)). The salt expires after 48 hours and cannot be recovered. Raw IP addresses are not stored.
  • Cookie mode: optional per site. Uses a first-party cookie for stable cross-day identity — stated here so it is not oversold as pseudonymisation.
  • In transit: TLS terminated at Caddy behind Cloudflare Full (Strict); HSTS with preload; security headers (CSP, nosniff, Referrer-Policy, Permissions-Policy).
  • At rest (application-level): Stripe and Polar API keys encrypted with AES-256-GCM; backup files encrypted with GPG AES-256. Live database volumes are not volume-encrypted — listed as a planned measure.

2. Confidentiality, integrity, availability and resilience

  • Authentication via magic-link email and optional Google sign-in (JWT sessions). Admin routes gated to a single allowlisted email address.
  • Production databases are reachable only on the private Docker network — no Postgres, ClickHouse or Redis ports published to the internet.
  • Cloudflare CDN / WAF / DDoS protection in front of the origin. Per-route rate limiting (authenticated APIs, event ingest, auth, contact form, and others).
  • Docker restart policies, healthchecks, memory limits and log rotation on every service. Deploy pipeline includes a health check and automatic rollback on failure.
  • Encrypted backups: Postgres daily, ClickHouse weekly (events, imported daily data, crawler hits and schema ledger). Restore procedure documented.

3. Restore capability

Backup encryption and restore procedures are in place. The CI recovery drill exercises encrypted backups and restoration using disposable databases. Off-site backups and a recorded production restore drill remain unverified operational measures.

4. Testing and evaluation

  • PR checks cover lint, types, builds and isolated regression suites.
  • Deploy health check with automatic image rollback.
  • Automated ErrorLog retention (90 days) and a daily admin error digest when errors occur. An operational watchdog checks worker heartbeats, queues, failed jobs and data-store availability.
  • Backup success/failure flag reviewed as part of operations.

Formal penetration testing, vulnerability scanning pipelines, access reviews and security training programmes are not yet established and are not claimed here.

5. Planned improvements

The following are tracked as planned, not current, measures:

  • Disk / volume encryption at rest
  • Off-site encrypted backups
  • Documented full restore drill
  • Explicit session lifetime configuration
  • Bounded retention for completed erasure and webhook receipts

Related