Security & Compliance
Eviworx Enterprise ITSM
As of: September 2026
Eviworx Software UG (haftungsbeschränkt)
This document summarizes the technical and organizational measures (TOM) of Eviworx and maps them to common requirements (GDPR, NIS2, supply chain security). It documents the current product and process status and does not replace a formal certification. Further evidence is available on request (see section 5).
Core Principle: On-Premise
Eviworx runs entirely within the customer's infrastructure. In regular operation, the vendor has no access to the customer's data. Data sovereignty therefore remains fully with the customer — a key advantage over SaaS solutions, especially for GDPR and NIS2 assessments.
1. GDPR
Technical measures implemented in the product:
| Requirement | Implementation in Eviworx |
|---|---|
| Data sovereignty | On-premise operation, no vendor access in regular operation |
| Access control | Role-based access control (RBAC) with dynamic roles; server-side enforcement |
| Authentication | MFA/TOTP, password hashing (PBKDF2-SHA512), optional Entra ID SSO |
| Encryption of sensitive data | AES-256-GCM for sensitive fields (e.g. TOTP secrets, license keys) |
| Data at rest and backups | Database volume, file attachments and backups are encrypted by the operator at storage or file system level — the application encrypts the sensitive fields specifically, not the entire volume. For an installation in your own data centre that layer belongs in the operating concept. |
| Outbound connection | The application regularly contacts the Eviworx licence check; what is transmitted are licence and count values, no content. Connections to Microsoft Entra ID, Teams, Webex or mailboxes only communicate once they are explicitly set up. |
| Accountability (Art. 5, 30) | Tamper-evident, SHA-256 hash-chained audit trail (DB trigger against tampering) |
| Data minimization in logs | Automatic PII scrubbing (email, phone, IBAN, tokens) in audit events |
| Data subject rights (access/erasure) | Self-service export (Art. 15/20, machine-readable JSON) and admin export; anonymization instead of deletion (Art. 17) with preflight blocker check and erasure hold (legal hold); configurable retention periods; direct DB access on-prem |
| Privacy organization | A dedicated role for the data protection function, freely composable — the shipped template grants insight into analytics and the audit trail, not the deletion of accounts; reporting path for data breaches on incidents |
2. NIS2
Beyond technical security, NIS2 primarily requires traceable security processes. Eviworx addresses this as follows:
- Published security policy with a central security contact (see section 6).
- Defined process for reporting and remediating vulnerabilities with target response times.
- Security updates: the container images are scanned for known vulnerabilities in our registry, and updates to the libraries used are reported automatically.
- Incident handling in the product (incident management incl. data breach flow) and organizationally.
- Hardened architecture: zero-trust virus scan, SSRF protection, rate limiting, security headers, TLS termination at the gateway.
Mapping to the measures under NIS2 Art. 21(2) (excerpt)
Which product functions support the individual areas of measures. The mapping is a guide for your own implementation — not legal advice and not a declaration of conformity.
| Area of measures | Support in Eviworx |
|---|---|
| a) Risk analysis & security policies | Asset inventory with per-asset criticality, relations between assets (depends on, installed on, part of), linking of assets to incidents, problems and changes. |
| b) Incident handling | Incident management with data-breach flow, SLA escalation levels, emergency changes with approval strategy, notifications via email, Teams, Webex and in-app. |
| c) Business continuity & recovery | Operation in your own infrastructure as a container platform with multi-instance capability; database backup and recovery are the operator’s responsibility and are described in the documentation. |
| d) Supply chain security | Contract management with terms, notice periods and expiry warnings for service providers and licenses; platform SBOM on request (section 3). |
| e) Acquisition, development, maintenance, vulnerabilities | Published security contact and reporting process (section 6), vulnerability scanning of container images, automated reporting of library updates. |
| f) Assessing effectiveness | SHA-256 chained audit history with chain verification, analytics and report builder with scheduled reports (CSV, XLSX, PDF). |
| g) Cyber hygiene & training | Knowledge base with visibility levels and publishing states for policies and guides; self-service forms for standardised reports. |
| h) Cryptography & encryption | TLS termination at the gateway, license keys and MFA secrets encrypted with AES-256-GCM, license-key views are logged. |
| i) HR security, access control, asset management | Role model with visibility scoping, per-role restrictions on asset types, handover and return records, stocktaking with target/actual comparison, absence and substitution rules. |
| j) Multi-factor authentication | TOTP MFA with backup codes, single sign-on via Microsoft Entra ID with daily user sync, role-bound API keys. |
3. Supply Chain Security
Eviworx is built on established open-source components (incl. Node.js, React, PostgreSQL, Redis). For transparency about the included components:
- Software Bill of Materials (SBOM) of the container images in the standard formats CycloneDX / SPDX — produced by the scan in our container registry, on request.
- Container images based on slim, hardened base images; regular updates.
- FIPS 140-2 compatible cryptographic algorithms (no official FIPS certification).
4. Technical Security (Overview)
- Tamper-evident SHA-256 hash-chained audit trail with integrity verification.
- RBAC with server-side enforcement; critical actions are freshly revalidated.
- MFA/TOTP, session management (view and terminate sessions), protection against repeated sign-in attempts: a lockout with increasing delay, plus an optional human check in front of it.
- Zero-trust virus scan for file uploads (scan worker without direct file access, quarantine).
- Central SSRF protection for outbound connections (webhooks); fail-closed.
5. Evidence & Documents on Request
Through the security contact we provide the following documents after review:
- Full TOM documentation (technical and organizational measures).
- SBOM (CycloneDX / SPDX) of the container images of the deployed version — on request.
- Data processing agreement (DPA) — relevant if optional support/maintenance services with data access are used (usually not required for pure on-premise operation).
- Further security-related evidence upon agreement.
6. Security Contact & Vulnerability Reporting
Please report security vulnerabilities confidentially to: security@eviworx.com
Target response times (first acknowledgement):
| Severity | First acknowledgement |
|---|---|
| Critical | 24 hours |
| High | 72 hours |
| Medium | 7 days |
We ask for responsible disclosure and no publication before a coordinated remediation.