DojoExpert Security Overview

This document provides an overview of the security architecture, technical safeguards and organisational measures implemented by Link Lab j.d.o.o. to protect Customer Data processed through the DojoExpert platform.

Contents

• 1. Executive Summary
• 2. Security Principles
• 3. Infrastructure
• 4. Data Hosting
• 5. Network Security
• 6. Authentication
• 7. Access Control
• 8. Encryption
• 9. Backup & Disaster Recovery
• 10. Monitoring & Logging
• 11. Secure Development
• 12. Vulnerability Management
• 13. Incident Response
• 14. Endpoint Protection
• 15. Third-Party Providers
• 16. Privacy by Design
• 17. Contact

1. Executive Summary

DojoExpert is a cloud-based software platform designed for sports clubs, associations and organisations. The platform is developed and operated by Link Lab j.d.o.o..

Protection of Customer Data is an integral part of the platform design. Security controls are implemented across the application, cloud infrastructure and operational processes to reduce the risk of unauthorised access, accidental loss or disclosure of information.

Security measures are reviewed periodically and updated where appropriate to address operational requirements and evolving security risks.

2. Security Principles

DojoExpert follows several fundamental security principles.

3. Infrastructure

DojoExpert is hosted using cloud infrastructure provided by Google Cloud Platform.

Development and production environments are maintained separately to reduce operational risk.

4. Data Hosting

DojoExpert utilises infrastructure located within the European Union and the United States.

Depending on the specific service involved, Customer Data may be processed using infrastructure located in either region.

International transfers are protected using appropriate safeguards as described in the Data Processing Agreement.

5. Network Security

All communication between users and the DojoExpert platform is protected using industry-standard encryption protocols.

Only services required for operation of the platform are exposed to the public network.

6. Authentication

User authentication is implemented using Microsoft ASP.NET Identity.

Password Security

• Passwords are never stored in plain text.
• Password hashes are generated using ASP.NET Identity.
• Password reset requires verification through the registered e-mail address.
• User authentication is performed exclusively through encrypted HTTPS connections.

Administrative Authentication

Administrative access to critical cloud infrastructure is protected using Multi-Factor Authentication (MFA).

Future security enhancements may include optional or mandatory Multi-Factor Authentication for Customer administrator accounts.

7. Access Control

Access to information is controlled through role-based permissions implemented within the DojoExpert platform.

Role-Based Access Control

• Users can access only information permitted by their assigned role.
• Administrative permissions are assigned individually.
• Access rights are granted according to operational responsibilities.
• The principle of least privilege is applied wherever practical.

Administrative Access

Production systems may be accessed only by authorised Link Lab personnel where necessary to provide technical support, maintenance or operational services.

Administrative access is limited to individuals who have been explicitly authorised to perform such activities.

8. Encryption

Encryption is used to protect Customer Data both during transmission and while stored within cloud infrastructure.

Link Lab relies on Google Cloud managed encryption services for storage encryption and infrastructure protection.

9. Backup & Disaster Recovery

Backup procedures are designed to support recovery following unexpected data loss or operational disruption.

Backups are not intended as a long-term archive of Customer information.

Expired backups are automatically removed through the configured backup retention process.

10. Monitoring & Logging

The DojoExpert platform is monitored to help maintain service availability, identify operational issues and support incident investigation.

Monitoring information is used to assist with platform reliability, performance analysis and troubleshooting.

11. Secure Development

Security considerations are incorporated throughout the development and maintenance of the DojoExpert platform.

• Development and production environments are maintained separately.
• Application updates are tested before deployment to production.
• Security improvements are implemented as part of the ongoing development process.
• Access to source code and production systems is restricted to authorised personnel.

Security is considered throughout the software development lifecycle, taking into account the size, complexity and operational requirements of the platform.

12. Vulnerability Management

Link Lab periodically reviews the platform and supporting infrastructure to identify and address known security risks.

• Operating system and application updates are applied where appropriate.
• Microsoft Defender is used to provide endpoint protection for administrative systems.
• Security improvements are implemented as vulnerabilities become known and practical mitigations are available.

Where appropriate, security patches are installed following assessment and testing.

13. Incident Response

Link Lab maintains procedures for responding to security incidents affecting the DojoExpert platform.

Incident response activities may include:

• Identification of the incident.
• Containment of the affected systems.
• Assessment of the scope and impact.
• Recovery of affected services.
• Implementation of corrective measures where appropriate.

Where required by applicable law or contractual obligations, Customers will be notified without undue delay following confirmation of a Personal Data Breach affecting their information.

14. Endpoint Protection

Administrative systems used to manage the DojoExpert platform are protected using commercially supported endpoint protection software.

15. Third-Party Providers

DojoExpert uses carefully selected third-party service providers to support operation of the platform.

Additional subprocessors may be introduced where operationally necessary. Customers will be informed in accordance with the Data Processing Agreement.

16. Privacy by Design

Privacy and data protection considerations are incorporated into the design and operation of the DojoExpert platform.

• Only information required to provide the service is processed.
• Role-based permissions restrict access to Customer Data.
• Customer accounts may request deletion of their data.
• Security and privacy considerations are reviewed during development of new functionality.

These measures support compliance with the General Data Protection Regulation (GDPR) and other applicable privacy requirements.

17. Contact

Questions regarding information security or data protection may be directed to:

Link Lab j.d.o.o.
Perini 14
52448 Sveti Lovreč
Croatia

E-mail:
info@linklab.hr

Document Information