Data security and disaster recovery

This page describes how the ProfiSprávceSVJ website, client portal and mobile app and the SVJ Monitor app store, protect and back up data. We only describe what we actually do. The legal details of personal data processing are in the privacy policy and the SVJ Monitor privacy policy.

1. Where we store data and how we protect it

Where

Portal and app data is stored in databases run by Neon and Supabase in EU data centres in Frankfurt (Germany) and Ireland. Uploaded photos and documents are kept in Supabase storage in the EU. Electronic signatures of documents are handled by our own OpenSign instance, which we run in the Czech Republic.

The website and the server side of the portal are hosted by Vercel. The portal's server functions run in its Frankfurt (Germany) data centre, close to the databases, so data is also processed in the EU while a request is handled.

Encryption

All traffic to the website, portal and apps is encrypted with HTTPS (TLS), and browsers are told to always use an encrypted connection (HSTS). The databases and file storage encrypt data at rest on the provider side. We also encrypt backups ourselves, see section 2.

Who can access data

In the portal, each user sees only the data of their own building association, according to their role (owner, committee, manager). Permissions are checked on the server, and the database also enforces per-row rules (row level security). In SVJ Monitor, uploaded statements and bylaws are kept in your account's private storage.

Only the operator, Martin Pohl, and the automated tools he manages have access to the administration and the production databases. Keys for the e-mail service, AI and other services are kept only on the server, never in the app or the browser.

Sign-in

You can sign in with a one-time code sent by e-mail, a password, or a third-party account (Apple, Seznam). Passwords are never stored in readable form, only as a hash. One-time codes and links expire. Website forms are protected against bots by Cloudflare Turnstile. Face ID and fingerprint checks happen only on your phone; biometric data never reaches us.

2. Backups and disaster recovery

What we back up

The ProfiSprávceSVJ portal database and the SVJ Monitor database, including user accounts, and the source code of the apps. Uploaded files (photos, documents) are kept by the storage provider. A separate backup of files is being prepared.

How often and where

A backup is created automatically every night and stored with a different provider from the one that runs the databases, in EU storage. Nightly backups are kept for 8 days and older ones are deleted automatically. The portal database can also be restored to any point in time within the last few hours.

Encryption and access to backups

Backups are encrypted before they are sent to storage. The decryption key is not stored with any of the providers. The backup job connects to the databases with a separate account that can only read data.

Restore testing

We last tested a restore from backup in October 2026 and plan to repeat the test regularly.

Internal targets

Our internal target is to lose at most the last 24 hours of data in a disaster and to have the services running again within 4 hours. These are the targets our backups and recovery procedure are designed for, not a contractual guarantee.

What happens in an outage

We follow a written recovery procedure. First we secure whatever still works and delete nothing. We restore into a new environment and switch over only after checking the data. We tell the committees of affected building associations and SVJ Monitor users by e-mail what happened, what it means for their data and when to expect recovery. During a longer outage we also post an update on the website.

3. Subprocessors

These providers process data on our behalf. We list what we use them for and where the data is or where the company is based. Transfers to the USA are governed by each provider's data processing terms.

ProfiSprávceSVJ (website, portal, app)

SVJ Monitor

Public data about building associations and companies comes from public registers (ARES and the commercial register). Only the company ID is sent to them.

4. Retention, deletion and export

For ProfiSprávceSVJ, retention periods follow the privacy policy, for example 6 months for enquiry form data and 10 years after the end of the contract for the association's accounting records, as required by law. In SVJ Monitor we keep data for as long as the account exists. You can delete your account in either app under Settings. Deleted data also disappears from backups within 8 days, when the oldest backup expires.

On request we will send you a copy of your data in a machine-readable form. When a management contract ends, we hand over to the association or the new manager the data and documents needed to continue management.

You have the right to access, rectification, erasure, restriction of processing, portability and objection. Send your request to svj@martinpohl.cz (ProfiSprávceSVJ) or hello@martinpohl.cz (SVJ Monitor). You can lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).

5. Security incidents and contact

If you find a security issue, write to svj@martinpohl.cz with the subject "Security". Describe what you found and how to reproduce it. Please do not try to access other people's data, and give us time to fix the issue before you publish it. Rules, scope and safe harbor are described in our vulnerability disclosure policy. The contact is also listed in /.well-known/security.txt.

In an incident we first stop it from spreading, replace the affected keys and passwords and find out which data is involved. If personal data is at risk, we report the incident to the Czech data protection authority within 72 hours as GDPR requires, and we inform affected people and association committees without undue delay.

Back to home