Security and Data Protection

1. Scope and purpose

This document sets out the technical and organisational measures adopted by Mondra to protect the information entrusted to it by its clients and collected from visitors to the websites it builds and maintains.

It covers the websites published by Mondra, the administration platform through which each client manages the content of their own website, and the contact details collected on Mondra's own website.

It is intended for clients, prospective clients and data subjects who wish to understand how information is protected. It is not technical documentation and does not describe the architecture of the systems in detail, for security reasons.

2. Guiding principles

Mondra's approach to information security rests on four principles:

• Least privilege. Every party, human or automated, holds only the access strictly required for the function it performs.
• Minimisation. Only the data necessary for the purpose at hand is collected, and only for as long as that purpose subsists.
• Defence in depth. Protection does not rest on a single mechanism. The failure of one layer does not, in itself, expose the protected data.
• Verifiability. A security measure that is not tested is not considered implemented. The protections described in this document are subject to periodic verification.

3. Access control and authentication

Access to the administration platform requires individual authentication by email address and password. There are no accounts shared between clients and no generic credentials.

Passwords are not stored by Mondra in readable form. They are managed by a dedicated authentication service which retains them solely as an irreversible cryptographic hash. Under no circumstances does Mondra have access to a client's password.

Privileged administrative credentials, which would allow access restrictions to be bypassed, are never transmitted to the user's browser nor embedded in published code. They are used exclusively in a controlled environment and for maintenance operations.

The administration platform is explicitly excluded from search engine indexing. Its address is nonetheless reachable from the public website: the protection of the data rests on the measures described in this document and not on the address being unknown.

4. Separation of client data

Each client has access solely to the information of their own business. A client authenticated on the administration platform cannot view, create, modify or delete content belonging to any other client.

This separation is the most critical control of the platform and warrants a precision: it does not depend on the behaviour of the application, on the user's browser, or on any check performed on the client side. It is enforced at the data layer, which evaluates the authenticated identity on each operation, individually, and refuses any read or write outside the scope of the client concerned.

The consequence is material: even if the code running in the browser were modified in its entirety by a malicious user, or if requests were issued directly to the data services outside the interface provided, the outcome would be the same: access is refused.

The identity of each account is determined by attributes that the user cannot modify. Attributes under the user's control are not used in authorisation decisions.

Content that a client chooses to publish on their website is, by its nature, accessible to the public, which is the purpose of a website. Content marked as unpublished remains accessible only to the client to whom it belongs.

5. Protection of data in transit and at rest

All communication between users' browsers and Mondra's services is encrypted using TLS. Access over an unencrypted protocol is redirected automatically.

Data is stored on the infrastructure of providers that apply encryption at rest and maintain periodic backups, in data centres located within the European Union.

Security headers are applied to server responses in order to mitigate known classes of attack, namely improper interpretation of content type, unauthorised framing of pages on third-party sites, and excessive disclosure of referrer information.

The administration platform is not retained in cache by network intermediaries.

6. Verification of the measures

Separation between clients is verified by means of a suite of adversarial tests, executed from a real user session rather than in a simulated environment.

The tests deliberately attempt, from the standpoint of an authenticated client:

• to read records belonging to another client, including unpublished records;
• to create records attributed to another client;
• to modify and delete another client's records;
• to transfer a record of their own to another client, circumventing ownership checks;
• to create records with no attribution of ownership;
• to obtain elevated privileges by manipulating attributes under the user's own control.

The suite also includes tests in the opposite direction, confirming that the restrictions do not prevent a client from carrying out legitimate operations on their own content. A protection that prevents the owner from reaching their own data is treated as a failure, not a success.

The suite is executed before a new access is granted and following any change to the access control rules. Any result diverging from the expected outcome prevents the access from being granted or the change from being published.

Mondra does not, at present, have automated execution of these tests integrated into a continuous publication process. Execution is triggered manually at the points indicated.

The most recent execution took place in September 2026, covering ten checks across three distinct client scopes, with a conforming result in all of them. The execution record may be requested through the contact given in section 13.

7. Processing of personal data

Mondra processes personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation) and applicable national law.

On Mondra's own website, the data voluntarily provided through the contact form is collected for the sole purpose of responding to the enquiry submitted. The lawful basis is the legitimate interest in responding to contact initiated by the data subject.

No traffic analytics, profiling or behavioural advertising tools are used. No cookies are set for those purposes.

No payment data is collected or processed.

Data subjects may at any time request access to, rectification of, erasure of, restriction of the processing of, and portability of their data, and may object to the processing, through the contact given in section 13. Requests are answered within the period prescribed by law.

Data subjects further have the right to lodge a complaint with the national supervisory authority, the Comissão Nacional de Proteção de Dados.

8. Retention and erasure

Contact details collected are retained for the period necessary to deal with the enquiry and any subsequent contractual relationship, and are erased once they are no longer necessary for the purpose that prompted their collection.

Content managed by each client is retained for the duration of the service. Upon termination of that service, the client may request the export of their content, as well as its erasure, which is carried out on request.

9. Use of third parties

Mondra engages three specialist providers, which act as processors and process the data solely for the provision of the services contracted. As at the date of this version, they are:

Netlify

Hosting of the websites and receipt of messages sent through the contact form.

Resend

Delivery of the administration platform's automatic messages, namely account confirmation and password reset.

Supabase

Authentication of administration platform users and storage of the content managed by each client.

Mondra gives preference to providers that ensure processing within the European Economic Area or that offer adequate safeguards under Chapter V of the General Data Protection Regulation, and is in the process of reviewing the corresponding data processing agreements.

The identification of these providers is intended to allow the data subject to know who processes their data. It transfers no responsibility to them: as regards the client and the supervisory authority, the controller is Mondra, and the measures described in this document are Mondra's responsibility and not that of third-party policies.

The typefaces used on the pages are served from Mondra's own infrastructure. No resource is obtained from third parties while pages load, and consequently visitors' IP addresses are not transmitted to any other entity by that means.

This list is updated whenever there is a change of provider, by means of a new version of this document.

10. Incident management

A security incident is any unauthorised access to, disclosure of, alteration of or destruction of data.

Upon a confirmed incident, Mondra proceeds to immediate containment, to determining the scope and causes, and to remedying the vulnerability that gave rise to it.

Affected clients are informed without undue delay, with an indication of the nature of the incident, the data involved and the measures taken. Where the incident is likely to result in a risk to the rights and freedoms of data subjects, notification to the supervisory authority is made within seventy-two hours, under Article 33 of the General Data Protection Regulation.

Reports of vulnerabilities by third parties are welcome and may be made through the contact given in section 13. Mondra undertakes not to pursue any adverse action against anyone reporting a vulnerability in good faith, provided they have not accessed third-party data or degraded the service.

11. Client responsibilities

The security of the platform also depends on sound practice by those who use it. It falls to each client:

• to use a password unique to this platform, not reused on other services;
• not to share credentials, including between staff of the same business;
• to report immediately any suspicion of misuse of their account;
• to request revocation of access for staff who leave.

Mondra never asks a client for their password, by any means, including email, telephone or message.

12. Limitations of this statement

This document describes measures actually implemented as at the date indicated. In the interest of transparency, it also makes clear what is not being stated.

Mondra does not, at present, hold formal information security certifications, namely ISO/IEC 27001, nor audit reports of the SOC 2 type. No penetration testing is carried out by independent external parties, and there is no security monitoring on a continuous basis.

Mondra is a small organisation and scales its measures in accordance with the nature, scope and risks of the processing it carries out. No information system can be regarded as entirely immune to compromise.

This document does not constitute a contractual warranty. Mondra's obligations towards each client are set out in the corresponding services agreement.

13. Contact

Questions relating to information security, personal data protection, the exercise of data subject rights or the reporting of vulnerabilities should be addressed to:

mondra.pt@hotmail.com

Mondra undertakes to acknowledge receipt of any communication relating to security within three working days.