Built on Security & Compliance
CDE 19650 Cloud is designed from the ground up to meet international security standards, European data protection regulations, and ISO 19650 requirements.
Standards & Compliance
ISO 19650 — Fully Compliant
The platform natively implements all requirements of ISO 19650-1 (concepts and principles) and ISO 19650-2 (delivery phase): 4 CDE states, 4 organizational roles, naming convention, permissions matrix, audit trail, and information delivery process.
- ISO 19650-1: Concepts & Principles
- ISO 19650-2: Delivery Phase
- ISO 19650-5: Security (implemented)
GDPR — Full Compliance
All data is stored in Romania on Microsoft Azure infrastructure, ensuring data sovereignty within the EU. Lawful basis for processing, right to access/erasure, data minimization, and breach notification procedures fully implemented.
- Data stored in Romania (EU)
- Right to erasure implemented
- Data processing agreements available
- Breach notification < 72h
Romanian BIM Regulation — MDLPA Order 2224/2023
Romania officially adopted BIM requirements for public construction projects through MDLPA Order 2224/2023. CDE 19650 Cloud is fully aligned with these requirements, providing the compliant CDE environment mandated for public projects.
- Common Data Environment as required
- ISO 19650 workflow implemented
- Romanian naming conventions supported
- Audit trail for public procurement
ISO 27001 — In Progress
Information Security Management System certification in progress. Key controls already implemented: access control, encryption, vulnerability management, incident response, and business continuity.
- Access control policies
- Encryption at rest and in transit
- Vulnerability management
- Incident response plan
Technical Security Measures
Encryption
TLS 1.3 in transit. AES-256 at rest. Per-tenant key management.
Authentication
Multi-factor authentication (MFA). SSO/SAML enterprise support. Session management with auto-expiry.
Access Control
Role-Based Access Control (RBAC) with 4 ISO 19650 roles. Per-project and per-document permissions. IP whitelisting for Enterprise.
Audit Trail
Every action logged with timestamp, user, IP address and details. Immutable audit log. Export for external audit.
Backup & Recovery
Automated daily backups. RPO < 1 hour. RTO < 4 hours. Geographically redundant storage within EU.
Penetration Testing
Annual penetration testing by independent security firm. Vulnerability disclosure program.
Infrastructure
Need a security questionnaire or DPA?
Our team can provide detailed security documentation, data processing agreements, and answer any compliance questions.