This Appendix describes the minimum technical and organisational measures Zippendo implements to protect personal data processed on the Customer's behalf. It corresponds to Appendix C.2 in the published DPA template.
C.2.1 Core Security Standards
Zippendo maintains appropriate technical and organizational measures designed to ensure a level of security appropriate to the risks associated with the processing, taking into account the state of the art, implementation costs, and the nature of the platform's logistics and routing services.
Regardless of specific system updates, Zippendo commits to the following minimum standards:
- Encrypted Communication: All external data transmissions, public APIs, and user interfaces are secured using robust, industry-standard cryptographic protocols (HTTPS/TLS) in transit.
- Tenant Isolation: The platform enforces logical database-level or application-level tenant isolation, ensuring that one customer organization cannot access, view, or modify the data of another.
C.2.2 Access Control and Authentication
- Role-Based Access Control (RBAC): Internal access to Zippendo's production environments, databases, and administrative tools is strictly restricted to authorized employees on a need-to-know basis and is governed by defined access roles.
- Multi-Factor Authentication (MFA): Multi-factor authentication is supported for Customer users. All Zippendo administrative personnel, developers, and support agents authenticate exclusively via Google Workspace OAuth with strictly enforced 2-Step Verification (2SV) using hardware security keys or authenticator applications. Password-only administrative access is disabled system-wide.
- Credential Protection: User passwords and sensitive authentication tokens are stored using salted, industry-standard cryptographic hashing functions. Session cookies are configured with appropriate security attributes (such as HttpOnly, Secure, and Lax/Strict SameSite flags) and short-lived expiration windows.
- API Security: Access to the platform's APIs requires cryptographically secure, scoped tokens. API rate-limiting is implemented globally and on sensitive authentication endpoints to protect against brute-force and denial-of-service attacks.
- Support Impersonation Safeguards: To assist with troubleshooting, Zippendo support staff may temporarily view a Customer's dashboard context using a secure support impersonation feature under the following strict conditions:
- Impersonation is only enabled upon the Customer's explicit request (e.g., support tickets) or to resolve critical technical incidents.
- Access is restricted to designated support personnel.
- All impersonation sessions are governed by time-limited access tokens that expire automatically.
- Every impersonation event, including the agent's identity and timestamp of mutations, is recorded in an append-only administrative audit log.
C.2.3 Application, Infrastructure and Physical Security
- Secure Cloud Hosting: All primary application servers, background processors, and databases are hosted in professional, physically secure data centers within the EU/EEA featuring biometric controls, continuous surveillance, and redundant power supplies.
- Encryption at Rest: Primary databases, file storage volumes, and document archives containing personal data are encrypted at rest using industry-standard AES-256 encryption.
- Backup and Disaster Recovery: Zippendo maintains regular, automated backups of critical databases. Backups are stored securely in encrypted formats and are subject to robust retention and automatic deletion cycles to ensure disaster-recovery resilience without unnecessary long-term retention.
- Configuration and Secret Management: API credentials, encryption keys, and environment secrets are managed outside of source code, stored in secure secret vaults, and excluded from built application images.
- System Logging and Monitoring:
- Automated diagnostic logging and error tracking are active across all application layers.
- Structured application logs automatically redact sensitive values, authorization headers, and credential fields before being stored or exported.
- Error monitoring and system telemetry tools are configured to filter, mask, or strip out recipient/consignee personal data prior to ingestion.
- Session recording and analytics tools are configured with strict masking rules to block inputs and prevent the capture of personal identifiers.
- Application and Diagnostic Logs: Application and diagnostic logs generated during platform operation may transiently capture shipment metadata (including consignee names, delivery addresses, and tracking identifiers) to ensure system security, maintain operational performance, diagnose errors, and support troubleshooting. These diagnostic logs are stored securely with restricted access, are segregated from core customer databases, and are automatically deleted on a rolling 14-day retention cycle.
C.2.4 Vulnerability and Patch Management
- Dependency Auditing: Zippendo utilizes automated monitoring tools to scan code libraries, third-party packages, and container base images for known security vulnerabilities and updates dependencies regularly.
- Secure Software Development: Development workflows utilize isolated environments. Code changes and database migrations are reviewed and deployed through automated, secure continuous integration (CI/CD) pipelines.
C.2.5 Audit, Inspection, and Support Logs
- Impersonation Logs: Zippendo maintains comprehensive, append-only administrative audit logs of support impersonation mutations. These logs are retained for a minimum of 90 days and made available to the data controller upon reasonable request to verify compliance.
- Assistance and Cooperation: Upon reasonable written request with at least 30 days' notice, Zippendo will provide available information necessary to demonstrate compliance with Article 28 GDPR and these Clauses.