Security
Security controls, shared responsibilities and reporting.
Protecting access
DAWN separates account identity from organisation membership and permissions. Application code checks authenticated identity, organisation context and authorised actions. Passwords are hashed and verification and access tokens expire. Authorised file access is separate from possession of an object address.
These controls support access boundaries; they are not a guarantee that software has no defects. Organisations must keep administrators and memberships current and use only authorised accounts.
Transport, files and providers
Public website and application connections use HTTPS. Deployment records document private object storage, signed file access and verified encrypted database connections. Provider credentials belong in server configuration, not public browser code. AI and telephone gateways separate provider execution from application permissions.
A storage region is not a guarantee that all support, diagnostic or provider processing remains in that region. The Subprocessors page explains the distinction. No zero retention or dedicated environment promise is made by this overview.
Records and recovery
Governance events and provider usage records support investigation and accountability. Some records use hashes or redacted metadata to reduce content exposure. A hash linked to a user or event can still be personal data. General diagnostics must not be assumed anonymous.
Backups, object versions and deletion require their own controls. We do not publish an unverified recovery time, recovery point, availability percentage or deletion deadline. Contracted requirements must be recorded in the customer’s service and processing schedules. This page does not claim ISO certification, SOC attestation or a completed independent penetration test.
Report a concern
Send a suspected vulnerability or security incident to hello@dawnhcm.com. Include the affected service, time, a concise description and non-sensitive reproduction steps. Never send passwords, tokens, private keys or real personnel files. Stop testing if you encounter another person’s data.
We assess reports and coordinate containment and any required notifications with the responsible parties. Reporting does not authorise intrusive testing, access to other accounts or public disclosure of confidential data. For a customer data breach, the DPA requires notification without undue delay after awareness.
Contact
Stockholm IT Academi AB · 559337-9141
Fallskärmsgatan 1 lgh 1302, 128 34 Skarpnäck, Stockholm, Sweden.