Security Policy

Cowiqyu is committed to maintaining the security, integrity, and confidentiality of all data processed through our platform at cowiqyu.pro. This Security Policy outlines the technical and organizational measures we implement to protect our systems and the information entrusted to us by our users, participants, and partners.

This policy applies to all systems, infrastructure, applications, and data managed or operated by Cowiqyu, including our web platform, backend services, communication channels, and any third-party integrations used to deliver our online seminar services.

We apply the following core principles to all data handling activities:

• Data is collected only to the extent necessary for the delivery of our services.
• Access to personal and sensitive data is restricted to authorized personnel only.
• Data is stored using industry-standard encryption both at rest and in transit.
• Retention periods are defined and enforced in accordance with our data retention schedule.
• Data integrity is maintained through validation, checksums, and audit logging.

• Our platform is hosted on infrastructure that complies with recognized international security standards.
• Network traffic is protected using TLS 1.2 or higher for all data in transit.
• Firewalls, intrusion detection systems, and network segmentation are employed to limit exposure.
• Production environments are isolated from development and staging environments.

• Operating systems and software dependencies are kept up to date with security patches applied on a regular schedule.
• Unnecessary services and ports are disabled on all production servers.
• System configurations follow established hardening guidelines and are reviewed periodically.

• All sensitive data stored in our databases is encrypted at rest using AES-256 or equivalent algorithms.
• Encryption keys are managed using dedicated key management practices and rotated on a defined schedule.
• Backups are encrypted prior to storage and transmitted over secure channels.

• User authentication is enforced through secure credential mechanisms including hashed password storage.
• Multi-factor authentication is available and encouraged for all user accounts.
• Session tokens are issued with defined expiration periods and invalidated upon logout.
• Failed authentication attempts are rate-limited to mitigate brute-force attacks.

• Access to platform resources is governed by role-based access control principles.
• Users are granted the minimum level of access required to perform their intended functions.
• Administrative access is restricted to verified personnel and subject to enhanced authentication requirements.
• Access rights are reviewed and updated when roles change or access is no longer required.

• All internal access to production systems is logged and monitored.
• Remote access by staff is conducted over secure, encrypted connections.
• Access credentials are never shared between individuals.

• Security considerations are integrated into the software development lifecycle from design through deployment.
• Code is reviewed for security vulnerabilities prior to release.
• Common vulnerability classes including injection attacks, cross-site scripting, and cross-site request forgery are addressed through both coding standards and technical controls.
• Dependencies and third-party libraries are monitored for known vulnerabilities and updated promptly.

• All user-supplied input is validated and sanitized before processing.
• Output is encoded appropriately to prevent injection and rendering vulnerabilities.
• File uploads are restricted by type, size, and content and are scanned where applicable.

• Regular vulnerability assessments are conducted on our platform and infrastructure.
• Penetration testing is performed periodically by qualified internal or external reviewers.
• Identified vulnerabilities are prioritized and remediated according to their severity level.

• System events, authentication activities, and administrative actions are logged in a tamper-resistant manner.
• Logs are retained for a defined period sufficient to support security investigations and compliance requirements.
• Automated monitoring systems are in place to detect anomalous activity and generate alerts.
• Security alerts are reviewed and escalated according to defined response procedures.

Security incidents are detected through automated monitoring, user reports, and periodic reviews. Incidents are classified by severity to ensure appropriate prioritization of response efforts.

• A defined incident response process is maintained and tested periodically.
• Responsible personnel are assigned to lead investigation and containment efforts.
• Affected systems are isolated where necessary to prevent further impact.
• Root cause analysis is conducted following significant incidents, and corrective actions are implemented.

In the event of a security incident that affects user data, affected parties will be notified in a timely manner consistent with applicable obligations. Notifications will include the nature of the incident, the data involved, and the steps taken in response.

• Third-party service providers with access to our systems or data are evaluated for their security practices prior to engagement.
• Contractual agreements with vendors include security and data protection obligations where applicable.
• Third-party integrations are reviewed periodically and access is revoked when no longer necessary.
• We do not sell or transfer user data to third parties for purposes unrelated to service delivery.

Physical access to infrastructure hosting our platform is managed by our hosting providers, who maintain physical security controls including access restrictions, surveillance, and environmental protections. Our own offices and workspaces are secured against unauthorized physical access, and equipment containing sensitive information is subject to appropriate handling and disposal procedures.

• Data backups are performed on a regular schedule and stored in geographically separated locations.
• Backup integrity is verified periodically through restoration testing.
• Business continuity plans are maintained to ensure service availability in the event of disruption.
• Recovery time and recovery point objectives are defined and reviewed as part of continuity planning.

• All personnel with access to systems or data receive security awareness training.
• Staff are required to adhere to internal security policies and acceptable use guidelines.
• Security responsibilities are included in onboarding procedures and reinforced through periodic training.
• Personnel are required to report suspected security incidents or policy violations promptly.

We welcome responsible disclosure of security vulnerabilities identified in our platform. If you believe you have discovered a security issue, please contact us at [email protected] with a description of the potential vulnerability. We ask that you refrain from publicly disclosing the issue until we have had a reasonable opportunity to investigate and address it. We are committed to acknowledging reports promptly and working toward resolution in good faith.

This Security Policy is reviewed at least annually and updated as necessary to reflect changes in our systems, practices, legal obligations, or the threat landscape. Continued use of our platform following any update to this policy constitutes acceptance of the revised terms.

For questions, concerns, or reports related to the security of our platform, please contact us through the following channels:

• Email: [email protected]
• Phone: +48 602 243 861
• Address: Cowiqyu, Krakowska 60, 43-300 Bielsko-Biała, Poland