Security & compliance

• Aspatium OOD is an EU company with no non-EU parent.Confirmed
• The servers are in our own facility in Bulgaria.Confirmed
• Customer data stays in the EU, under EU law.Commitment

• Named accounts with MFA for every person with access.Commitment
• Access from allow-listed IP addresses.Commitment
• Access logs are kept for five years.Commitment
• Access from restricted jurisdictions is blocked.Commitment

• Certification to ISO/IEC 27001:2022 is in progress.In progress

• Every customer passes KYC and sanctions screening before access.Commitment
• Screening is repeated every year.Commitment
• Organisations headquartered in, or owned from, a restricted jurisdiction are not accepted.Commitment

Prohibited uses and customers are listed in our Acceptable Use Policy and Export compliance statement.

• Our position on DORA, GDPR and the AI Act is under legal review.In progress

• No tracking or advertising cookies.Confirmed
• Everything loads from our own domain, except Cloudflare Turnstile on the request form, which stops automated spam.Confirmed

Report a vulnerability to security@aspatium.com. The same contact is published for researchers at /.well-known/security.txt.