European cloud providers
At Repejo, we exclusively use European cloud providers for the processing and storage of information where we act as a data processor. This means that we do not transfer data to third countries. Our providers are European companies, not American cloud giants. This means that neither we nor our providers are subject to the CLOUD Act. You can therefore rest assured that all personal data remains within the EU. We usethe Swedishcompany GleSYS,theFinnishcompany Upcloud, andthe Dutchcompany AppSignal. All three are certified according to ISO 27001:2013. All personal data is processed and stored in data centers in Sweden.
Encryption
Repejo adheres to industry standards regarding encryption. We use strong standard encryption—or the encryption required by our partners—for all communications. Personal data stored with our providers is stored in encrypted form, known as "encryption at rest." Our services are only available via encrypted connections.
Organizational security measures
Every organization that is a client of ours receives its own separate database schema. This means that clients’ data is never mixed, which reduces the risk of data breaches. Repejos staff do not have access to your database. If you would like assistance from our support team, you must invite us into your organization. This means that you are the ones who control who has access to your donors’ personal data. All our staff are bound by confidentiality agreements.
Technical security measures
We exclusively use two-factor authentication for our own logins with our suppliers.
Repejo is built using the Phoenix and Ecto frameworks, which include built-in protection against SQL injection, XSS, and CSRF. We follow best practices for the frameworks and tools we use.
GDPR
In relation to the donor, you are the data controller and Repejo is your data processor. In addition to complying with the GDPR through the technical and organizational measures we implement, we naturally help you manage your donors’ rights. This means that we assist with tasks such as generating data subject access requests and deleting personal data. Since we do not have client trust accounts and do not save receipts or accounting data, we believe that if a donor requests deletion, you can completely delete their personal data from our systems. Giva Sverige recommends deleting donor data after 36 months if the donor is no longer active, and this is the standard in our systems. Deletion occurs automatically unless you notify us otherwise. Deletion is carried out through anonymization, which means you can still obtain transaction statistics but cannot link them to a specific individual.
In short, we help you comply with the GDPR, and this is, of course, included in the fixed price. For more information, please read the Data Processing Agreement in our Terms and Conditions. The link to the agreement can be found at the bottom of the page.