Trust & Security
This page is maintained by FRACCE & Company s.r.o. to answer common security and privacy questions about FRACCE and the GFWS platform. It describes controls that are currently in place and how responsibility is shared between FRACCE, our underlying cloud platform, and you as a customer. It is not an independent certification or third-party audit report.
Shared responsibility
FRACCE builds and operates the GFWS application. The application runs on managed cloud infrastructure that provides hosting, the managed database, authentication services and email delivery. FRACCE is responsible for application logic, access policies, configuration and the data we choose to collect. Customers are responsible for keeping their account credentials safe and for the accuracy of the information they submit.
Authentication & access
Customer-facing accounts (where applicable) are authenticated via the managed identity service of our cloud platform. Sessions use signed tokens and are transmitted over HTTPS. Administrative access to production systems is restricted to a small number of authorized FRACCE personnel.
Data protection
All traffic between your browser and our services is encrypted in transit using TLS. Data is stored in the managed database provided by our cloud platform, which encrypts data at rest. Access to application data is enforced at the database layer using row-level security policies, so records are returned only to the roles allowed to read them.
Data we collect
We collect only what we need to operate the service: contact and pre-order form submissions, basic account details where applicable, and minimal technical metadata used to deliver and secure the service. A full description is available in our Privacy Policy.
Subprocessors & integrations
FRACCE uses a limited set of service providers to run the platform, including a managed cloud backend (hosting, database, authentication) and a transactional email provider used to deliver service emails from our verified sending domain. We do not sell personal data and we share data with these providers only as required to operate the service.
Email & communications
Service emails are sent from our verified domain notify.fracce.com with SPF and DKIM configured. Every non-essential message includes a one-click unsubscribe link, and bounces and unsubscribes are tracked so we do not contact people who have opted out.
Cookies & analytics
We use a small number of cookies needed to operate the site and, where applicable, privacy-respecting analytics to understand aggregate usage. See our Cookie Policy for details.
Data retention & deletion
We retain personal data only as long as needed to provide the service and meet legal obligations. Customers may request access, correction or deletion of their personal data at any time by contacting gfws@fracce.com.
Vulnerability reporting
If you believe you have discovered a security issue affecting FRACCE or GFWS, please email gfws@fracce.com with the details and steps to reproduce. Please do not publicly disclose the issue before we have had a reasonable opportunity to respond.
Compliance posture
FRACCE & Company s.r.o. is established in the European Union and processes personal data in accordance with GDPR. FRACCE does not currently claim SOC 2, ISO 27001, HIPAA or PCI certification. Where certification statements are needed for procurement, please contact us directly.
Contact
Operator: FRACCE & Company s.r.o., IČO 14446260. Security and privacy contact: gfws@fracce.com.
This page is editable project content maintained by FRACCE and is not presented as an independent verification or certification.