Security

This page describes controls that are implemented or limitations that are explicitly acknowledged. It does not turn planned work into a present-tense promise.

This page is the technical and organisational measures documentation referenced in the Privacy Policy.

2.1 In transit

• HTTPS enforced across all subdomains.
• HSTS active: max-age=31536000; includeSubDomains; preload (1 year, full subdomain coverage, preload-ready).
• TLS 1.3 preferred; TLS 1.2 minimum (Cloudflare edge default).

2.2 At rest

• The public site is delivered as Cloudflare Workers Static Assets; DiagnosticMind does not operate a D1 or R2 data store for it.
• The assessment Worker uses Cloudflare Rate Limiting for a soft burst limit and a Durable Object for an exact daily request-attempt ceiling. The Durable Object stores only a date-scoped count; it receives no IP address, assessment answer, or report.
• Contact correspondence is held by the configured email providers, as disclosed in the Privacy Policy.

Operator-side access

• There are no public user accounts or stored user passwords on the site.
• Administrative access is limited to the operator and the accounts required to run the service.
• API credentials and signing secrets are supplied through Cloudflare environment secrets and are not embedded in the public static bundle.

• Dependency updates — assessed during maintenance and before deployment; no public remediation SLA is claimed.
• Security review — local verification includes reproducibility, secret scanning, code-contract tests, and browser/HTTP checks appropriate to the change.
• Penetration testing — planned at the first enterprise contract; external pentest (€3–8k) is a best-effort defensible deferral consciously accepted at this stage. Commitment increases to annual once the first enterprise customer signs.
• Bug bounty — none at this stage. This is typical at this stage and will be reviewed at scale.

6.1 Detection

• Cloudflare service dashboards and provider records are available for incident investigation.
• User-reported anomalies and security disclosures are reviewed manually.
• No continuous security-operations centre, verified weekly log-review cadence, or guaranteed automated 5xx alert is claimed.

6.2 Notification timeline

Where a personal-data breach is likely to risk individuals' rights and freedoms, the competent authority is notified without undue delay and, where feasible, within 72 hours of awareness under GDPR Article 33. Affected individuals are informed without undue delay where the breach is likely to result in a high risk under Article 34, subject to the Article 34 exceptions.

6.3 Reporting a security issue

If you believe you have discovered a security vulnerability in the DiagnosticMind platform, please email contact@diagnosticmind.eu with subject line Security disclosure. Please do not publicly disclose the issue until it has been triaged and acknowledged.

There is no formal bug bounty programme at this stage. Reports are acknowledged within 5 business days.

Providers that handle Personal Data are listed on the Privacy Policy page (Section 4): Cloudflare, Anthropic, Resend, and Proton for the currently implemented services.

The Privacy Policy links to their public data-processing terms. Whether each document is incorporated into the specific account agreement, and whether every optional transfer or security setting is active, remains subject to account-level and legal verification.

For full transparency:

• External penetration testing is not yet conducted; committed at first enterprise contract. Internal review and dependency scanning are the current controls.
• Bug bounty programme — not yet established.
• Formal SOC 2 / ISO 27001 certification — not pursued at this stage. The platform's security posture leans on the certifications of its sub-processors plus the controls documented above.

These residuals are accepted consciously, not concealed.