Trust Center

Data and privacy for website visitors

atvari.eu works without user accounts and without cookies, and it does not track visitors. The contact form sends nothing to us: it opens your own email client with the message prefilled, and nothing leaves your device until you send it. There is no advertising, no tracking scripts, and no embedded third-party widgets on the site.

• We set no cookies, and analytics is aggregate: it runs without personal data.

Purposes, legal bases, your rights under the GDPR, the server logs of the host, and the terms of each provider listed below: all of that is in our privacy policy.

Hosting and providers

Four providers are involved with this website:

Where available, provider names link to their data processing agreements.

Data and privacy for clients

The client relationship draws on the following documents:

• Base agreement: a Master Services Agreement (MSA) plus an engagement-specific statement of work (SOW), agreed with you directly; the SOW determines whether the engagement is a service contract or a contract for work and services.
• Data Processing Agreement (template): signed per engagement.
• Sub-processor annex: the authoritative list of sub-processors; part of the DPA.
• Technical and organisational measures (TOMs): the security-measures baseline the DPA references.

Where an engagement needs something different, that is agreed in the statement of work; the public templates stay uniform for everyone.

Sub-processors for client projects

For client projects, the following providers process data on our behalf. Their data processing agreements are linked. Client engagements use our standard data processing agreement (template); the authoritative list (with data categories, the 14-day objection procedure and the deletion rules) is our [sub-processor annex (/documents/annex-v1.0-en.pdf), which this table mirrors:

The providers engage further sub-processors, which they document on their own sites. Client agreements contain the full details.

Security controls

We keep "state of the art" concrete. The essence: access only via personal need-to-know accounts with multi-factor authentication, encryption on every machine and in transit, separated production and client environments with no shared accounts, and backups held by the service providers. The TOMs annex (v1.0) puts all of it in contract wording, as part of our DPA.

Vulnerability management

Dependencies are pinned with lockfiles and enter projects only through reproducible, reviewed changes; the same discipline applies to the code we ship for clients. Security advisories are reviewed on an ongoing basis: critical items are mitigated within 7 days, everything else follows the monthly update cycle. Releases are controlled by atvari, so an update never reaches a client project without a deliberate, reproducible step.

Incident response

atvari runs no production systems of its own; the services above are operated by the providers. Should we become aware of a security incident affecting data we process for a client, we notify them within 48 hours, as our data processing agreement requires: containment, remediation, and a written summary follow.

Report a security issue

Found a problem with this website, such as content that does not match what we publish, unexpected behaviour, or a transport-security issue? Email security@atvari.eu with the subject line "Security disclosure". We aim to acknowledge reports within a few business days, and we ask for a reasonable window to fix the issue before anything is published. Our contact is also available as /.well-known/security.txt. We also accept encrypted reports (PGP): our keys are discoverable through the Web Key Directory (WKD), and security.txt pins the disclosure key's fingerprint alongside a lookup URI that always serves the current key.

Internal AI tooling

We use AI tooling for our own engineering work. Client personal data is out of scope of this internal use: in client work, data appears only in the services listed under "Sub-processors for client projects", under the agreements described there.