Security & Compliance
Exiqze runs on infrastructure we own and operate in Bulgaria, inside the EU. Your data never leaves the jurisdiction unless you choose a service that requires it.
Where your data lives
Production runs on our own clustered hardware in Plovdiv, Bulgaria: two load-balanced web nodes, a multi-node database cluster and redundant storage. Off-site encrypted copies are kept in the EU. We do not rent capacity from US hyperscalers for core services.
How we protect it
- Encryption in transit — TLS 1.2+ with modern ciphers on every endpoint; certificates renew and deploy automatically.
- Tenant isolation — every record is partitioned by tenant; API keys are scoped to one tenant and can be pinned to IP addresses.
- Access control — role-based permissions down to field level, two-factor verification by SMS or e-mail, audit logs of admin actions.
- Backups — daily encrypted database, file and virtual-machine backups to an off-site location; a full restore is rehearsed every month and the result is logged.
- Resilience — automatic failover between web nodes; the web tier keeps serving sites even if primary storage is unavailable; documented disaster-recovery runbooks.
- Vulnerability management — regular authenticated scans of every server and external scans of every public endpoint; findings tracked to closure; web application firewall and malware scanning on hosted sites.
- Monitoring — health checks every few minutes with automatic recovery and on-call escalation; status published on our Status page.
Compliance
- GDPR — we act as processor for our customers under a standard Data Processing Agreement; sub-processors are listed and changes announced.
- Standards — our processes follow ISO 9001 and ISO 27001 practice. Exiqze EOOD held ISO 9001:2015 and ISO 14001:2015 certification (CERTIND, certificates 17325 C / 17325 M, 2017–2020) for software, hosting, cloud CRM/ERP and web development services; recertification is planned.
- Accessibility — WCAG 2.1 AA / EN 301 549, see our Accessibility Statement.
- Vendor questionnaires — we complete SIG Lite, CAIQ and customer security questionnaires on request and can provide restore-test logs, scan reports and architecture diagrams under NDA.
Public sector and tenders
Exiqze is delivered as a cloud service on our infrastructure, one tenant per organisation, with perpetual right of use for the delivered configuration, training, and warranty support. Source code is not transferred. See Public Sector & Tenders.