This Security Measures Schedule (“Schedule”) describes the control domains used to protect QuizRace and the personal data processed through it. It constitutes Annex II to the QuizRace Data Processing Agreement.
1 Governance and Policies
1.1 [Confirm information-security governance framework, policy owner, approval cycle and risk-assessment cadence].
1.2 [Confirm privacy-by-design, asset-management and exception-management processes].
2 Personnel Security
2.1 [Confirm background screening where lawful and appropriate].
2.2 The owner of Attensi’s cloud organisation removes a leaver’s access to the production cloud environment, including any personal API keys. [Confirm confidentiality undertakings and security training frequency].
3 Access Control
3.1 Access to the production cloud environment is limited to four named people: one owner and three administrators. Each automated integration uses its own API key, limited to the one service it needs. [Confirm least-privilege approval and periodic access review process].
3.2 Multi-factor authentication is enforced for everyone with access to the production cloud console. Accounts lock after five failed sign-in attempts, console sessions expire after 30 days, and API keys are valid for at most one year. Production secrets are held in Scaleway Secret Manager. [Confirm MFA and password controls for other workforce systems].
4 Encryption
4.1 Connections to QuizRace over the internet are encrypted with TLS 1.2 or TLS 1.3, and earlier versions are refused. Connections from the application to its database are encrypted with TLS. Connections to its cache are not encrypted; they travel only over a Scaleway Private Network that cannot be reached from the internet.
4.2 [Confirm encryption at rest scope, algorithms, key ownership, rotation and storage].
5 Network and Application Security
5.1 The managed database and cache have no public endpoint and are reachable only from the application over a Scaleway Private Network. The storage bucket for uploaded images is private and cannot be listed or read without credentials. [Confirm protective monitoring controls].
5.2 QuizRace accepts only HTTPS connections and sends a Content Security Policy and HTTP Strict Transport Security with its responses. Every request for a quiz is checked against the requesting user’s workspace membership. Sign-in and account requests are rate limited per email address, and AI generation is rate limited per user. Scaleway’s infrastructure provides baseline protection against distributed denial-of-service attacks.
6 Secure Development and Change Management
6.1 Every pull request runs type checking, linting, the automated test suite, a dependency vulnerability audit and a filesystem vulnerability scan. [Confirm secure development lifecycle, code-review requirements and security testing].
6.2 Production is deployed only from the main branch. Each deployment re-runs the type check and the test suite, builds a container image, rolls it out and checks the public health endpoint. [Confirm change approval, segregation of duties and rollback process].
7 Vulnerability Management
7.1 Dependencies are audited and the code repository is scanned for known vulnerabilities on every pull request. [Confirm severity methodology and remediation targets].
7.2 [Confirm independent penetration-test scope, frequency, latest date and summary availability].
8 Logging and Monitoring
8.1 Application logs are kept for 7 days, database logs for 30 days and performance metrics for 31 days, all in Amsterdam, and can be read only by the people with access to the production cloud environment. [Confirm security event logging scope].
8.2 [Confirm alerting, monitoring coverage, escalation and time synchronisation].
9 Business Continuity, Backup and Recovery
9.1 The production database is backed up once a day, and each backup is kept for 7 days in Amsterdam, the same region as the database. Restoring from backup was last tested on 29 September 2026. [Confirm backup encryption].
9.2 QuizRace runs in a single region, with one application instance and one database server and no standby or automatic failover. If the database is lost it is restored from the most recent daily backup, so up to 24 hours of data may be lost; the restore test on 29 September 2026 took about three minutes. [Confirm business-continuity and disaster-recovery plans, test frequency and recovery time objective].
10 Incident Response and Personal Data Breaches
10.1 [Confirm incident-response plan, roles, exercises, forensic preservation and lessons-learned process].
10.2 [Confirm processor-to-controller breach-notification workflow and contact route].
11 Physical and Environmental Security
11.1 QuizRace is hosted by Scaleway in its Amsterdam (nl-ams) region, on Serverless Containers, Managed PostgreSQL, Managed Redis and Object Storage. AI question generation uses Scaleway Generative APIs, and email is sent through Scaleway’s transactional email service, both in Paris. Scaleway is certified to ISO/IEC 27001:2022 by BSI (certificate IS 787020). The certificate covers its infrastructure platform, including Object Storage, the private network and identity and access management, at data centres in Amsterdam and Paris; it does not list Scaleway’s managed database, cache, serverless container, AI or email services. According to Scaleway, every data centre hosting its infrastructure is certified to ISO/IEC 27001, and the operator of each controls physical access and protects against environmental threats such as fire and flooding.
11.2 [Confirm office access, visitor and device protection controls relevant to service administration].
12 Subprocessor Assurance
12.1 [Confirm security and privacy due-diligence criteria before appointment].
12.2 [Confirm contractual controls, ongoing monitoring cadence and material-change review].
13 Payment Security
13.1 QuizRace does not currently offer paid Plans or process payments.
14 Certifications and Audit Evidence
14.1 [Confirm current certifications, scope, issuing body and expiry, or state none].
14.2 [Confirm available audit reports, coverage period, distribution restrictions and request process].
15 Review and Changes
15.1 Attensi may update these measures from time to time as technology and risks evolve, provided that the overall level of protection is not materially reduced. The owner of this Schedule is [security schedule owner]. This Schedule was last reviewed on [security schedule review date].