Intygio Trust Center

Documented cybersecurity strategy

Cybersecurity strategy and risk appetite are documented and reviewed by leadership every quarter. Strategy is cross-walked against NIS 2 Article 21 and the NIST Cybersecurity Framework so a single statement of intent maps to both.

Supply chain risk management

Third-party providers processing customer data are inventoried in the Subprocessor Register. Each entry carries purpose, region, services consumed, and last-review date. New providers are announced before activation.

Effectiveness assessment of security measures

Security measures are continuously evaluated through automated gates on every code change, plus quarterly third-party penetration testing. Closure of every confirmed finding produces either a permanent regression test or a new automated check.

Roles, responsibilities, and authorities

Security responsibilities are documented; ownership of each control category is explicit. Leadership has decision authority and accountability for security outcomes per NIS 2 governance requirements.

Production asset inventory

Production system assets are inventoried through infrastructure-as-code. Inventory includes ownership, data classification, and change history. Refreshed automatically on every deploy.

Risk assessment cadence

Risk assessments are performed quarterly and on any material change to the environment, regulation or supplier set. Each assessment produces a prioritised mitigation backlog with named owners.

Data classification and inventory

Customer data and trust-path data are classified; processing and retention are documented in the Data Processing Agreement.

eIDAS-aligned electronic seals on every passport

Every Digital Product Passport is signed with an eIDAS-aligned advanced electronic seal. A Qualified Electronic Seal (QSealC) from an EU-listed Qualified Trust Service Provider is contracted and activates when our QSCD is operational. Signing keys are sealed at rest and never stored in plaintext.

Post-quantum-ready signatures

Signing infrastructure is designed to remain verifiable through the cryptographic transition ahead. Passports issued today do not require re-signing as standards evolve.

Key management policy

A documented key management policy covers generation, storage, rotation, use, and destruction of every cryptographic key on the trust path. Trust-path signing keys are held in certified hardware security modules.

Data encryption at rest and in transit

Customer data and credentials are encrypted at rest. All network traffic between Intygio services and between Intygio and customers is encrypted in transit. Trust-path key material never leaves the secure boundary in plaintext.

Personal identifier minimisation in operational data

Email addresses and other direct identifiers do not appear in operational logs or audit metadata. Where a log entry must be associated with an account, only an indirect identifier is recorded.

Least-privilege production access

Production system access is least-privilege, time-bounded, and audit-logged. Access reviews run quarterly with documented outcomes. Multi-factor authentication is enforced for all human access to production systems.

Secure software development lifecycle

Software development follows a documented lifecycle with automated security checks at key stages. No change reaches production without passing defined gates.

Trust-critical dependency control

Software dependencies on the signing and verification path are actively managed and reviewed before adoption. Vulnerable dependencies are addressed on a documented schedule.

EU data residency by default

Customer data is processed and stored within the European Union by default. Region is configurable per tenant under contract when a customer requires it.

Cyber hygiene and training

Operating personnel follow documented cyber-hygiene practices including secret management, secure development training, and incident-recognition awareness. Training is refreshed annually.

Continuous vulnerability scanning

Software dependencies and production systems are continuously scanned against authoritative vulnerability databases. Critical and high-severity findings carry documented remediation SLAs and are tracked to closure.

Append-only audit chain per passport

Every lifecycle event for every passport is recorded in a tamper-evident log. The complete event chain is available for audit purposes.

Trust-path integrity monitoring

EU trust list infrastructure is verified on a regular schedule. Trust store health is monitored continuously and any degradation is treated as a service concern.

Quarterly adversarial penetration testing

Adversarial penetration testing runs every quarter across the signing, verification and trust-path surfaces. Every finding is closed with a permanent regression test or a new automated check, so a closed finding cannot silently reopen. An independent third-party engagement follows when revenue justifies the audit cycle.

Documented incident response runbook

Security and privacy incidents follow a documented response runbook with defined detection, escalation, customer notification timers, and post-incident review. NIS 2 Article 23 timers apply when scope-triggered.

Customer notification commitments

Customers are notified of security-relevant incidents per the timers in the Master Service Agreement. Material incidents are escalated immediately with a follow-up written report within 72 hours.

Emergency revocation drill

A drill exercising the key-compromise revocation path runs annually. Covers signer suspension, customer notification, and re-issuance under a fresh credential.

Anonymous concern reporting

A confidential channel is available for reporting security or compliance concerns. Reports are reviewed by leadership and resolved with documented outcomes.

Business continuity and disaster recovery plans

Business continuity and disaster recovery plans document recovery time and recovery point objectives per service tier. Plans are tested annually with documented exercise outcomes.

Customer data backup and restore

Customer data backups follow a documented schedule and recovery procedure. Restore drills are run at documented cadence; restore success is verified, not assumed.

Post-incident improvement loop

Every incident produces a post-incident review with concrete improvement actions. Improvements feed into either a regression test or a new automated check, never a memo-only resolution.