Personal Data Processing Agreement

Article 1 — Definitions

The terms “personal data”, “processing”, “controller”, “processor”, “data subject”, “personal data breach” and “data protection impact assessment” have the meaning given to them by Regulation (EU) 2016/679 of April 27, 2016 (the “GDPR”). In the Agreement, the following capitalized terms have the meaning set out below:

• “Applicable Law”: the GDPR, French Law No. 78-17 of January 6, 1978 on information technology, data files and civil liberties, and any text supplementing or replacing them.
• “Service”: the Finozio platform, its reports, alerts and exports, the Aurora assistant and, for the Custom Plan, the automation rules, within the limits of the Plan purchased.
• “Plan”: each of the Free, Audit Spring, Pilot, Scale Up and Custom offerings described at finozio.com/offres.
• “Microsoft Environment”: the Microsoft Entra ID tenant(s), Azure subscriptions and Microsoft 365 tenants that the Customer connects to the Service.
• “Connection Credentials”: the items the Customer entrusts to Finozio to access its Microsoft Environment, namely the identifier and secret of an app registration (Service Principal), or the refresh token obtained when a Customer user connects their Microsoft account (OAuth).
• “Customer Personal Data”: the personal data that Finozio processes on behalf of the Customer as part of the Service, described in Annex 1.
• “Microsoft 365 Snapshot”: the state recorded at the end of each Microsoft 365 analysis (licenses, accounts and, depending on the Plan, usage), kept for display, comparison over time and export.
• “Sub-processor”: any provider to which Finozio entrusts all or part of the processing of Customer Personal Data.

Article 2 — Purpose and Scope

2.1 The Agreement applies to all processing of Customer Personal Data carried out by Finozio to provide the Service, whatever the Plan, for as long as Finozio holds such data.

2.2 The Agreement does not apply to processing for which Finozio acts as controller, described in its privacy policy (finozio.com/politique-confidentialite): management of platform user accounts (name, business email address, role, two-factor authentication factors), billing, platform security and audit log, prospecting and quote requests, free scans performed without an account, website audience measurement.

2.3 Where the Customer itself acts as a processor on behalf of a third party, for example an integrator or partner connecting its own customers’ Microsoft Environment to the Service (in particular with the Scale Up Plan, which allows several tenants to be analyzed), the Customer warrants that it is authorized in writing by that third party and that the obligations of the Agreement are at least equivalent to those binding it to that third party; Finozio then acts as sub-processor.

Article 3 — Description of the Processing

3.1 The subject matter, duration, nature and purpose of the processing, the type of personal data and the categories of data subjects are described in Annex 1, Plan by Plan. The scope of the data read grows with the Plan: no Microsoft 365 data for the Free Plan, accounts holding a license for Audit Spring, the entire directory and application usage from Pilot upwards.

3.2 Finozio accesses the Microsoft Environment using the Connection Credentials. In Microsoft 365, the Service only reads: no write operation is performed there, whatever the Plan. In Azure, only the automation rules of the Custom Plan, defined by the Customer’s administrators, stop, resize or delete resources; deleting a disk erases the data it contains, on the Customer’s instruction. The Service never accesses the content of resources, files or mailboxes: it only reads their metadata, costs and usage metrics.

3.3 Finozio does not process Customer Personal Data for its own purposes. It does not use it for its own prospecting, to train artificial intelligence models, or to assess data subjects. Finozio may produce aggregated statistics from the amounts, volumes and rates already computed for each client (for example the average share of unused licenses), provided that they identify neither the Customer nor any data subject; no data identifying a person enters into them.

3.4 The Service is not intended to process special categories of data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10). The Customer shall not include any such data in the names and tags of its Azure resources or in the questions it asks Aurora.

Article 4 — Customer’s Documented Instructions

4.1 Finozio processes Customer Personal Data only on documented instructions from the Customer. These instructions consist of: the Agreement and its annexes, the Terms, the Terms of Sale, the Plan purchased, and the connections, analyses, exports, settings, rules and deletions that the Customer performs in the Service or requests in writing at contact@finozio.com.

4.2 Any additional or different instruction is given in writing. Where it extends the scope of the Service, it may be subject to a quote.

4.3 Finozio immediately informs the Customer if, in its opinion, an instruction infringes Applicable Law. Finozio may then suspend the execution of the instruction concerned until the Customer confirms it in writing or amends it.

4.4 If Finozio is required by Union or Member State law to which it is subject to carry out processing not provided for by the instructions, including a transfer to a third country or an international organization, it informs the Customer before processing, unless that law prohibits such information on important grounds of public interest.

Article 5 — Customer’s Obligations

5.1 The Customer determines the purposes and essential means of the processing. It chooses the Plan, the tenants and subscriptions it connects, and the permissions it grants to the Service: for Microsoft 365, the Microsoft Graph “Application” permissions Organization.Read.All, Reports.Read.All and Directory.Read.All and, optionally, AuditLog.Read.All; or, if it connects the Service with its Microsoft account (OAuth), the delegated rights of the signed-in user.

5.2 The Customer warrants that it has a legal basis for the processing it entrusts to Finozio and that it has provided data subjects with the information required by Articles 13 and 14 GDPR. Where the data concerns its employees, it is for the Customer to assess whether a data protection impact assessment (Article 35 GDPR) is required, to inform them beforehand (Article L. 1222-4 of the French Labor Code) and, where applicable, to inform and consult its works council (Article L. 2312-38 of the same code), as the analysis of application and Copilot usage per user may be regarded as a means of monitoring their activity. The Customer shall not use the Service to assess the individual performance of data subjects.

5.3 The Customer can reduce the data transmitted to Finozio: if it does not grant the AuditLog.Read.All permission, the last sign-in date is not read; if it keeps the Microsoft 365 admin center option that conceals user names in usage reports (Microsoft’s default setting), no per-application usage data or mailbox size is recorded, and Copilot seats are recorded only under the opaque identifier provided by Microsoft.

5.4 The Customer documents in writing any instruction regarding the processing, remains the sole judge of whether to implement recommendations in its Microsoft Environment, and keeps control of the Service’s access, which it may restrict or revoke at any time in its Microsoft portal or by deleting the Connection Credentials in the Service.

Article 6 — Confidentiality

6.1 Finozio ensures that persons authorized to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. Each authorized person signs an individual confidentiality undertaking before any access.

6.2 Access to Customer Personal Data is restricted: on the one hand, to the users that the Customer authorizes in its account, within the limits of their role; on the other hand, within Finozio, to the persons holding the super-administrator role, designated by name in the platform configuration, for support, maintenance and the advisory services included in the Plan. Any access by a super-administrator to a tenant other than their own is recorded in the audit log. The list of the functions of authorized persons is provided to the Customer on written request.

6.3 The obligations of this article survive the end of the Agreement for five (5) years and, in any event, for as long as Finozio holds Customer Personal Data.

Article 7 — Security of Processing

7.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of individuals, Finozio implements the technical and organizational measures described in Annex 3, in accordance with Article 32 GDPR.

7.2 Finozio may update these measures, provided that the overall level of security is not reduced. Annex 3 describes the measures actually in place on the date of the Agreement; Finozio currently holds no certification and no third-party security audit report (in particular SOC 2 or ISO/IEC 27001).

Article 8 — Sub-processors

8.1 The Customer grants Finozio a general written authorization to engage the Sub-processors listed in Annex 2.

8.2 Finozio informs the Customer of any addition or replacement of a Sub-processor, by email to the account administrator, at least thirty (30) days before it takes effect. During this period, the Customer may object in writing on legitimate data protection grounds. Failing a solution agreed between the Parties, the Customer may terminate the Plan concerned without penalty, with a pro rata refund of amounts prepaid for the unexpired period.

8.3 Finozio contractually imposes on each Sub-processor the same data protection obligations as those of the Agreement, in particular sufficient guarantees to implement appropriate technical and organizational measures.

8.4 Finozio remains fully liable to the Customer for the performance by its Sub-processors of their obligations.

8.5 Third-party services that the Customer itself chooses to connect to the Service (Slack, Microsoft Teams or PagerDuty webhooks; Jira or ServiceNow integrations) are not Sub-processors: data is sent to them on the Customer’s instruction, and the Customer is responsible for those services.

Article 9 — Location and Transfers Outside the European Union

9.1 The platform is hosted on servers located in the European Union (Amsterdam, Netherlands), the database is located in the European Union (Paris, France) and the database backups are kept in France (Annex 1, section E).

9.2 Some Sub-processors are established in the United States or process data there (Annex 2). These transfers are governed by the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) or, for certified providers, by the EU–US Data Privacy Framework. The mechanism retained for each provider is set out in Annex 2. Finozio makes its assessment of these transfers available to the Customer.

9.3 Finozio does not transfer Customer Personal Data outside the European Union other than under these conditions, except on the Customer’s documented instruction or under the obligation set out in Article 4.4.

Article 10 — Assistance to the Customer

10.1 Data subject rights

Finozio forwards to the Customer, within five (5) business days, any request to exercise rights that it receives directly from a data subject concerning Customer Personal Data; it does not respond itself unless instructed by the Customer.

The Customer has the following means in the Service: CSV export of snapshots and analyses; deletion of all Microsoft 365 Snapshots of a client (reset function reserved to administrators, available with the Plans that include Microsoft 365, and recorded in the audit log); deletion of the Connection Credentials; deletion of the account. As the data read from Microsoft 365 reflects the Customer’s directory, it is rectified at the source, in Microsoft Entra ID, and taken into account at the next analysis.

Where these means do not make it possible to handle a request (for example erasing the data of a single person from stored snapshots, which no function of the Service currently allows), Finozio does so on the Customer’s written request within fifteen (15) days.

10.2 Security, impact assessment and prior consultation

Taking into account the nature of the processing and the information available to it, Finozio assists the Customer in complying with its obligations under Articles 32 to 36 GDPR. In particular, it provides the description of the processing (Annex 1) and of the security measures (Annex 3) needed for an impact assessment. Any assistance beyond these documents is charged on a time-spent basis, under a quote accepted by the Customer, unless it is made necessary by a breach by Finozio.

Article 11 — Personal Data Breaches

11.1 Finozio notifies the Customer of any personal data breach affecting Customer Personal Data without undue delay after becoming aware of it, and no later than forty-eight (48) hours thereafter, by email to the account administrator and, where the Customer has designated one in writing at contact@finozio.com, to its data protection contact.

11.2 The notification describes, where possible: the nature of the breach, the categories and approximate number of data subjects and records concerned; the name and contact details of Finozio’s point of contact; the likely consequences of the breach; the measures taken or proposed to address it and mitigate its effects. Where not all of this information can be provided at the same time, it is provided in phases without undue further delay.

11.3 It is for the Customer, as controller, to notify the breach to the competent supervisory authority and, where applicable, to communicate it to the data subjects. Finozio makes such notifications in the name and on behalf of the Customer only on the Customer’s written instruction.

11.4 Finozio documents any breach, whether notified or not: facts, effects and remedial action taken. Finozio applies a written internal breach management procedure (detection, assessment, notification to the Customer, register).

Article 12 — Retention Periods

12.1 While the Plan is in force, Finozio keeps Customer Personal Data for the periods set out in Annex 1 (section D), then erases it automatically.

12.2 Microsoft 365 Snapshots are kept for a rolling thirteen (13) months from their date, then deleted automatically every night; the most recent snapshot of each client is however kept for as long as the account exists, so that the Customer keeps an up-to-date baseline, subject to Article 13.1. This rule has been applied since September 29, 2026.

Article 13 — Return and Deletion of Data at the End of the Plan

13.1 At the end of a paid Plan, the Customer’s account is not deleted automatically: it reverts to the Free Plan and no new Microsoft 365 data is collected. As the Free Plan does not include Microsoft 365, the Microsoft 365 Snapshots can no longer be viewed in the Service; the Customer may request their export at contact@finozio.com (Article 13.2). Finozio deletes them ninety (90) days after the end of access, unless the Customer purchases a Plan that includes Microsoft 365 in the meantime. The other data already collected is kept within the periods set out in Annex 1.

13.2 At any time, and at the latest at the end of the Agreement, the Customer chooses between:

• return: the Customer exports its data from the Service (CSV exports and PDF reports) while its Plan allows it, or requests an export at contact@finozio.com made available within fifteen (15) days, in CSV format;
• deletion: the Customer deletes its account from the “My account” page (each of its users), or requests it in writing at contact@finozio.com carried out within fifteen (15) days, including the seven (7) day grace period. Deletion takes effect after a seven (7) day grace period, during which it can be cancelled. At its end, once the last user of the account is deleted, Finozio erases the Customer’s Microsoft 365 Snapshots, Azure data, Connection Credentials, Aurora conversations, automation rules and API keys.

13.3 Erased data disappears from backups, both the local and the remote copy, when their retention period expires (thirty (30) days, and one (1) year for the monthly copy). Only the data that Finozio must keep under Union or French law remains (billing data: ten (10) years), together with the audit log, each entry of which is kept for two (2) years and from which the email address, name and IP address of deleted users are removed.

13.4 It is for the Customer to revoke, in its Microsoft portal, the app registration or consent it had granted to the Service.

Article 14 — Documentation and Audits

14.1 Finozio makes available to the Customer the information necessary to demonstrate compliance with the obligations of Article 28 GDPR: the Agreement and its annexes, the up-to-date list of Sub-processors and, on request, an extract of the audit log relating to the Customer’s account.

14.2 The Customer may carry out, or have carried out by an independent auditor bound by professional secrecy and not a competitor of Finozio, an audit of compliance with the Agreement, no more than once a year, except in the event of a data breach or a request from a supervisory authority, with thirty (30) days’ prior written notice, first through a questionnaire and documents and then, if this is not sufficient, by an inspection during business hours, at the Customer’s expense. Finozio has no certification or third-party audit report that could replace it.

14.3 Finozio informs the Customer of any request from a supervisory authority concerning Customer Personal Data, unless prohibited by law.

Article 15 — Liability

15.1 Each Party is liable to data subjects under the conditions of Article 82 GDPR.

15.2 Between the Parties, Finozio’s liability under the Agreement falls within the single cap set out in Article 13 of the Terms of Sale (amount excluding VAT paid by the Customer during the twelve (12) months preceding the event giving rise to liability): this cap covers the Agreement, the Terms of Sale and the Terms together, without accumulation; it does not apply in the event of gross negligence or wilful misconduct, or where the law prohibits limiting liability.

Article 16 — Term

The Agreement takes effect on the date of its acceptance by the Customer, in the manner provided for in the recitals, and remains in force for as long as Finozio processes Customer Personal Data, including after the end of the Plan under the conditions of Article 13.

Article 17 — Miscellaneous

• Order of precedence — In the event of a conflict between the Agreement and the Terms or the Terms of Sale regarding the protection of personal data, the Agreement prevails, unless an accepted quote or signed special terms expressly provide otherwise.
• Amendment — Finozio may amend the Agreement to reflect changes in Applicable Law or in the Service, by informing the Customer by email thirty (30) days before it takes effect; a Customer who refuses an amendment that reduces data protection may terminate the Plan concerned under the conditions of Article 8.2.
• Governing law and jurisdiction — The Agreement is governed by French law. Disputes relating to the Agreement are settled in accordance with Article 17 of the Terms of Sale: an attempt at amicable resolution for thirty (30) days, then exclusive jurisdiction of the courts of Paris.
• Language — The Agreement is drafted in French. In the event of any discrepancy with a translation, the French version prevails.
• Contacts — For Finozio: contact@finozio.com; Finozio has not appointed a data protection officer. For the Customer: the account administrator or the data protection contact that the Customer designates in writing at contact@finozio.com.

Annex 1 — Description of the Processing

A. Subject matter, nature, purposes and duration

• Subject matter: provision to the Customer of Finozio’s FinOps Service, i.e. the analysis of its Azure spend and Microsoft 365 licenses.
• Nature: reading through application programming interfaces (Azure Resource Manager, Cost Management, Microsoft Graph) using the Connection Credentials; recording; structuring; matching licenses with usage; computing indicators and recommendations; storage; consultation by the Customer’s authorized users; export (CSV, PDF); transmission to the Sub-processors in Annex 2; erasure.
• Purposes: identify Microsoft 365 licenses that are unused, oversized, duplicated or assigned to disabled accounts; measure Copilot adoption; identify shared mailboxes licensed without need; allocate license costs by department; inventory and optimize Azure spend; produce the reports, alerts and answers of the Aurora assistant; for the Custom Plan, execute the automation rules defined by the Customer.
• Frequency: at each Microsoft 365 analysis launched from the Service; Azure costs are collected every night.
• Duration: the term of the Plan, then until erasure as provided in Article 13 and section D below.

B. Categories of data subjects

• Persons holding an account in the Customer’s Microsoft Entra ID directory: employees, executives, interns, temporary staff, contractors and, from the Pilot Plan upwards, external guests (“Guest” accounts); for the Audit Spring Plan, only accounts holding at least one license.
• Persons whose name or address appears in the name or tags of an Azure resource, or in the name of a shared mailbox.
• Platform users authorized by the Customer, for the content of their exchanges with Aurora.
• Recipients of alerts and reports designated by the Customer.

C. Personal data processed

C.1 Microsoft 365 data, read through Microsoft Graph. Only the fields listed below are requested from Microsoft; they are recorded in the Microsoft 365 Snapshot together with the computed indicators.

Where the Customer keeps the Microsoft 365 option that conceals names in usage reports, no per-application usage data or mailbox size is recorded, and Copilot seats are recorded only under the opaque identifier provided by Microsoft (Article 5.3).

C.2 Azure data (all Plans, scope depending on the Plan): tenant and subscription identifiers, resource inventory (names, identifiers, types, regions, configuration, tags), costs, usage metrics, Azure Advisor recommendations and reservations. This data is not personal data by nature; it contains personal data where the Customer names a resource or writes a tag with a person’s name or email address (for example a resource owner).

C.3 Data provided by the Customer in the Service: questions asked to Aurora and answers (from the Pilot Plan upwards); recipients of alerts and reports; settings, budgets and, for the Custom Plan, automation rules.

C.4 Connection Credentials: tenant ID, application ID and Service Principal secret, or OAuth refresh token of the Microsoft user who connected their account; encrypted in the database (Annex 3).

D. Retention periods

For reference, outside the scope of the Agreement (Finozio acting as controller): Azure and Microsoft 365 free scans — name, email address, company, job title, tenant and subscription identifiers and results kept for 90 days; secrets entered are never stored, unless the free monthly report is requested (box unticked by default): the secret is then kept encrypted while the report is active (12 reports at most) and deleted as soon as it stops; the email address is kept for 2 years in conversion statistics. Platform user accounts: for as long as the account exists, erased 7 days after a deletion request. Billing data: 10 years.

E. Location

• Application servers, including the cache: Amsterdam (Netherlands, European Union).
• Database: Paris (France, European Union).
• Backups: one local copy on a laptop administered by Finozio, located in France, which stays in the European Union and whose disk is fully encrypted (FileVault); one remote copy, encrypted before sending, deposited every night in Microsoft Azure storage located in France (France Central region) and replicated to the paired France South region.
• Error monitoring: European Union (Frankfurt, Germany).
• Transfers outside the European Union: see Annex 2.

Annex 2 — Authorized Sub-processors

List as of October 14, 2026, drawn up from the services actually used by the platform and the data processing agreements published by each provider. SCCs: European Commission standard contractual clauses. EU–US Data Privacy Framework: Commission adequacy decision of July 10, 2023.

A. Providers that process Customer Personal Data

Microsoft, as the Customer’s provider and the source of the data, is not a Finozio sub-processor for the data the Service reads through the Azure Resource Manager, Cost Management and Microsoft Graph APIs: it processes that data on the Customer’s behalf, under the contract between them.

B. Providers named in the privacy policy that receive no Customer Personal Data

Annex 3 — Technical and Organizational Measures

Listed here are the measures implemented in the platform, verified in its code as of October 8, 2026 and in its providers’ configuration as of October 14, 2026, and the organizational measures Finozio applies.

1. Platform access control

• Named accounts, restricted to business email addresses (server-side check at sign-up); password of at least 8 characters including an uppercase letter, a lowercase letter and a digit; authentication handled by Supabase Auth.
• Two-factor authentication with a TOTP app, offered to every user (optional for the Customer’s users) and mandatory for Finozio super-administrators; ten single-use backup codes, stored hashed; reset possible only by a Finozio super-administrator, with a stated reason, an audit log entry and an email to the account holder.
• Limit on the number of authentication attempts per account and API rate limiting.
• Session carried by httpOnly, Secure and SameSite=Lax cookies, lasting 2 hours; cross-site request forgery (CSRF) protection by double token; session revocation at sign-out.
• Application roles distinguishing the Customer’s administrators from other users; sensitive actions (data deletion, snapshot reset, management of Connection Credentials) are reserved to administrators.
• API keys stored hashed with a separate secret, limited by scope (read, write, delete), with an optional expiry date.
• Single entry point: the website and platform can only be reached through the Cloudflare proxy; since October 14, 2026, the hosting provider’s servers refuse requests that have not passed through Cloudflare, with the sole exception of the availability check. The domain is signed with DNSSEC.

2. Segregation between customers

• Shared database, segregated by tenant: every request is filtered server-side on the authenticated user’s tenant, and any request concerning another tenant is refused.
• Sole exception: Finozio super-administrators (Article 6.2), each of whose accesses to another tenant is recorded in the audit log.

3. Encryption

• In transit: HTTPS; on the website and application, one-year HSTS covering subdomains, nonce-based Content Security Policy (CSP) and X-Frame-Options (DENY) and X-Content-Type-Options (nosniff) headers.
• Connection Credentials (Service Principal secret, OAuth token): encrypted field by field before being written to the database with Fernet (AES-128 in CBC mode, authenticated with HMAC-SHA256); a single key, kept outside the database in the hosting provider’s configuration; manual rotation, with support for the previous key during the switchover and re-encryption of existing secrets.
• Other data, including Microsoft 365 data: no application-level encryption of its own; the database provider encrypts its disks and backups at rest, according to the security measures annexed to its data processing agreement.
• Secrets entered during a free scan are never stored, unless the prospect requests the free monthly report: the secret is then encrypted like the Connection Credentials above, and deleted as soon as the report stops.
• Remote copy of the backups: encrypted on the machine that produces it, before any sending (CMS format, AES-256-GCM); the private key needed to decrypt it is kept off that machine, by Finozio’s President, and Microsoft does not hold it.

4. Data minimization

• Read-only in Microsoft 365: read Microsoft Graph permissions, no write call.
• Only the fields listed in Annex 1 are requested from Microsoft Graph; the scope grows with the Plan.
• Microsoft 365’s name-concealment option is respected (Annex 1, C.1).
• Error monitoring is scrubbed before sending: no request body, local variables, secrets, email addresses, cookies or IP addresses; the Sentry organization, hosted in the European Union, is also set not to store IP addresses.
• The Aurora assistant receives no per-user Microsoft 365 data.
• Database backups exclude session tokens.

5. Logging

• Audit log of sensitive actions, including each access by a super-administrator to another tenant: actor, action, object, timestamp and, depending on the action, IP address; kept for 2 years; restricted to the Finozio team, which provides an extract to the Customer on request.
• Technical logs of the hosting provider, kept as set out in Annex 1, section D.

6. Availability and backup

• Continuous external availability monitoring; health check at each deployment.
• Daily logical backup of the production database, kept for 30 days, plus one monthly copy kept for 1 year; each backup is read back after writing, and a full restore was tested on September 24, 2026.
• Local copy: on a laptop administered by Finozio, located in France, whose disk is fully encrypted (FileVault) and whose backup folder is accessible only to its administrator’s account.
• Remote copy, since October 14, 2026: deposited every night in a Microsoft Azure storage account located in France (France Central region), geo-redundant to the paired France South region; encrypted before sending (§ 3); deposited with a token that only allows writing (no reading, no deletion); deleted automatically by Azure, after 30 days for daily copies and after 1 year for monthly copies, which move to cool storage after 30 days and to archive after 90 days.

7. Erasure

• Automatic daily purge according to the periods in Annex 1, section D.
• Account deletion with a 7-day grace period; purge of the Customer’s data upon deletion of its last user (Article 13).

8. Organization

• No data protection officer has been appointed; contact: contact@finozio.com.
• No certification (SOC 2, ISO/IEC 27001) and no third-party security audit report.
• Super-administrator access limited to persons designated by name (Article 6.2); staff confidentiality commitment (Article 6.1).
• Two-factor authentication required on administration accounts: GitHub organization (source code), Sentry organization, Stripe and platform super-administrators.
• Regular rotation of production keys and secrets (last full rotation: October 14, 2026).
• Breach management: written internal procedure (Article 11).