Security Policy

Pivetra implements comprehensive technical and organisational security measures (TOMs) in accordance with Art. 32 GDPR and BDSG to protect personal and business data processed through Hiver Ticket.

• All data stored in ISO 27001-certified data centres within Germany.
• Physical access to facilities is strictly controlled and monitored 24/7.
• Redundant infrastructure ensures high availability and disaster recovery.
• Regular independent security audits and penetration testing.

• Data in transit: TLS 1.2+.
• Data at rest: AES-256.
• Encrypted backups stored in Germany.
• Industry-standard key management practices.

• Role-based access control (RBAC) limits data access to authorised personnel.
• Multi-factor authentication (MFA) available and recommended for all accounts.
• Administrative access requires MFA and is fully logged.
• Access rights reviewed quarterly; revoked promptly on role change or departure.
• Principle of least privilege applied throughout.

In the event of a personal data breach, Pivetra will:

• Notify the BayLDA within 72 hours where the breach risks individuals' rights and freedoms (Art. 33 GDPR).
• Notify affected Controllers (customers) within 72 hours of discovery (Art. 33(2) GDPR).
• Notify affected individuals where the breach poses a high risk to their rights (Art. 34 GDPR).
• Document all breaches and responses in our breach register.

Report potential vulnerabilities responsibly to [email protected]. We acknowledge reports within 48 business hours and aim to remediate within 90 days before any public disclosure.

• All staff complete data protection and security training on onboarding and annually.
• All staff with data access have signed confidentiality agreements.
• Background checks conducted where permissible under German law.