Trust Center - YOUth Health Tech Germany UG
Compliance
Compliance Controls
Organizational Security
Physical security & workplace policies
11 Active
Organizational Security
Confidentiality or non-disclosure agreements
Legally binding confidentiality or non-disclosure agreements (NDAs) are systematically utilized to ensure personnel, vendors, and clients protect sensitive information from unauthorized disclosure.
Intellectual property rights
Measures and legal guidelines are implemented to identify, protect, and respect proprietary software, trade secrets, trademarks, and copyrighted material from unauthorized use or infringement.
Return of assets
Formal procedures are established to ensure all employees, contractors, and external parties return all corporate hardware, software, and data upon termination of employment or contract.
Security of assets off-premises
Security protocols and configurations are enforced to protect corporate hardware and information assets when used, transported, or stored outside the organization's primary physical boundaries.
Disciplinary process
A structured, formalized framework is maintained to address corrective actions against personnel who commit security breaches, violate established policies, or compromise organizational compliance.
Responsibilities after termination or change of employment
Security duties, non-disclosure obligations, and legal responsibilities that remain valid after an individual's role changes or employment ends are clearly defined and enforced.
Operation planning and control
Operational processes and IT activities are systematically planned, documented, and monitored to ensure the secure, consistent, and predictable delivery of corporate services.
Physical security perimeters
Defined physical boundaries, robust barriers, and access control mechanisms are established to protect corporate facilities and offices from unauthorized physical entry.
Protecting against physical and environmental threats
Measures such as fire suppression, backup power supplies, and climate controls are implemented to defend corporate facilities against natural disasters or environmental failures.
Working in secure areas
Specific behavioral guidelines, restricted procedures, and strict oversight are enforced for personnel operating within high-risk zones or areas containing sensitive infrastructure.
Equipment siting and protection
Critical hardware and IT infrastructure are positioned strategically within facilities to minimize environmental hazards, reduce visibility, and mitigate the risk of physical tampering.
Product Security
App security, code quality & testing
6 Active
Product Security
Development life-cycle
A structured governance framework is maintained to manage the software development lifecycle securely, embedding security reviews from initial planning to final release.
Code Quality
Automated and manual code review practices are enforced to ensure that software is secure, reliable, and compliant with modern industry coding standards.
Application information security
Measures are implemented to ensure that all data handled by applications is processed, stored, and managed in strict compliance with organizational security requirements.
Application testing
Regular security assessments, including vulnerability scanning and penetration testing, are performed on applications to proactively identify and remediate flaws.
Application distribution
Secure deployment pipelines and distribution channels are established to guarantee the integrity and authenticity of software updates and product releases.
Application security controls
Technical mechanisms and built-in security features are integrated directly into software applications to defend against logical exploits and vulnerabilities.
Technological Controls
Encryption, network security & access controls
16 Active
Technological Controls
Network management
Procedures and technologies are established to securely configure, monitor, and manage corporate networks, protecting them from unauthorized traffic and external threats.
Network encryption
Standardized cryptographic protocols are applied to protect data in transit across internal and external networks, ensuring confidentiality and preventing interception.
Endpoint security
Security measures and monitoring tools are deployed on all user and corporate devices to defend against malware, manage vulnerabilities, and prevent unauthorized access.
IT system security control
Comprehensive baselines and configuration controls are implemented to secure operating systems, servers, and core infrastructure assets against unauthorized modifications.
Authentication management
Robust policies and identity verification mechanisms are implemented to validate the identity of users and systems attempting to access organizational resources.
Session management
Secure controls govern the lifecycle of user sessions, preventing unauthorized reuse, hijacking, or lingering access to corporate applications.
Multifactor authentication
Multi-factor authentication (MFA) is globally enforced to add an extra layer of verification, heavily mitigating the risk of credential-based attacks.
Application access rights and login
Granular, role-based access controls and secure login interfaces restrict user privileges within applications to the minimum required for their business functions.
Password management
Strict password complexity policies, secure hashing for storage, and modern management practices are enforced to ensure credential strength and resilience.
Login failures and alerts
Mechanisms are in place to monitor, limit, and alert on failed authentication attempts, mitigating the risks of brute-force and credential-stuffing attacks.
Data encryption
Strong encryption-at-rest solutions are applied systematically to safeguard sensitive business and personal data stored on physical or cloud-based assets.
Hashing
Cryptographic hashing techniques are utilized to protect highly sensitive data elements, such as passwords or unique identifiers, ensuring they cannot be reversed.
Data quality and integrity
Validation checks and controls are implemented throughout the data lifecycle to prevent unauthorized alteration and ensure information remains accurate and consistent.
Backup
Regular, encrypted backups of critical data and systems are securely maintained and tested to ensure business continuity and reliable disaster recovery.
Logging system
A centralized logging infrastructure is deployed across the environment to capture comprehensive audit trails, system events, and security logs.
Log management
Formal processes are established for the secure retention, regular analysis, and protection of system logs against unauthorized tampering or premature deletion.
Data and Privacy
Privacy policies & data protection safeguards
15 Active
Data and Privacy
Lawfulness of the Processing
Processes are established to ensure that all data operations are based on valid legal grounds, protecting individual rights and complying with relevant regulatory principles.
Record of Processing Activities (RoPA)
A comprehensive inventory of data operations and systems is maintained to map the lifecycle, purpose, and ownership of processed information.
Internal policies and procedures
A formal framework of organizational policies, guidelines, and procedures is regularly updated, approved, and communicated to govern security and data protection.
Privacy Notices
Clear and transparent communication channels, such as privacy policies, are maintained to inform external parties about how their information is collected and processed.
Personnel designations
Clear roles, responsibilities, and accountability for data protection and information security are formally assigned and communicated across the organization.
Data Protection Officer (DPO)
A qualified individual or function is appointed to oversee the data protection compliance strategy, provide independent guidance, and act as a regulatory contact point.
Information Security Officer
A dedicated role or function is established to lead the information security program, manage risk, and ensure the overall resilience of the organization's infrastructure.
Internal security measures
Technical and organizational safeguards, including access controls and monitoring, are implemented to protect corporate systems and environments from unauthorized access or harm.
Classification of information
A structured framework is implemented to categorize information assets based on their sensitivity, legal requirements, and value to the organization.
Labelling of information
Rules and procedures are defined for marking and identifying information assets according to their assigned classification level to ensure proper handling and protection.
Data masking
Technical measures, such as pseudonymization or anonymization, are applied to obscure sensitive data, preventing unauthorized exposure while retaining functional utility.
Data Minimisation
Practices and systems are designed to limit the collection, access, and retention of information to only what is strictly necessary for the specified and intended purpose.
Data leakage prevention
Monitoring tools and procedural controls are deployed to detect, prevent, and mitigate the unauthorized transmission or exfiltration of sensitive information.
Protection of records
Secure management and archival processes are in place to safeguard key organizational logs, evidence, and records from alteration, destruction, or unauthorized disclosure.
Cookies Management
Mechanisms are implemented to govern the deployment of website cookies and tracking technologies, ensuring transparent user granular control over privacy preferences.
Data Governance
Data lineage, risk assessments & vendor oversight
6 Active
Data Governance
Data Protection Impact Assessment (DPIA)
Rigorous assessments are conducted to identify and mitigate data protection risks associated with new processing activities or technologies.
Record of Processing Activities (RoPA)
Comprehensive documentation of all data processing activities, including purposes, categories, and legal bases, is maintained for regulatory compliance.
Data stewardship and ownership
Formal roles and responsibilities are assigned to dedicated data owners and stewards to oversee the classification, quality, and compliant usage of corporate data assets.
Data quality governance
Continuous validation checks, metrics, and monitoring processes are established to ensure that key business and compliance data remains accurate, consistent, and fit for purpose.
Data lineage and traceability
Mechanisms are in place to map and trace the flow, transformation, and origin of data as it moves across various internal systems, databases, and analytical pipelines.
Third-party data governance
Rigorous onboarding processes, contractual clauses, and security assessments are applied to govern how data is shared with, processed by, and retrieved from external vendors.
Resources
Compliance Certificates
Technical Documentation
Preview
Loading...