Information Security Policy | Simple Commenter

Ander Digital OÜ — Simple Commenter

Document version: 1.1

Technical update: 21 September 2026

Owner: Aleksander Kaaberma, CEO / Information Security Officer

1. Purpose and scope

This policy defines requirements for protecting the confidentiality, integrity and availability of company and customer information. It covers personnel, workstations, the application, infrastructure, backups, integrations and AI processing.

Policy requirements describe the controls the company must maintain. They are not independent certification or evidence that a particular operational check has passed. Ander Digital OÜ does not hold ISO 27001 certification.

2. Service and data locations

The application is hosted on Vercel. The self-hosted MongoDB database, backups and S3-compatible file storage are hosted on Hetzner in Finland. Redis is in Stockholm. Application execution regions and individual provider configurations are recorded in operational deployment records.

Primary EU storage does not mean every processing activity stays in the EU. Email, payments, AI, analytics and customer-selected integrations may involve other locations. The Sub-processor List identifies those purposes and limitations. AWS storage is not in use.

3. Data classification

Class	Examples	Required handling
Public	Marketing and public documentation	Approved for publication
Internal	Operating procedures and business records	Authorized personnel only
Confidential	Feedback, screenshots, files, account details, AI conversations and outputs	Restricted access, protected transmission/storage, defined retention and deletion
Restricted	Password credentials, signing secrets, provider keys and integration tokens	Approved secret storage, least privilege and controlled rotation; never published or committed

AI prompts, tool results and screenshots may contain personal or confidential data even when dedicated identity fields are omitted. Sanitization reduces exposure; it is not a guarantee of anonymization.

4. Access control

Use individual administrative accounts, least privilege and MFA on provider accounts wherever supported.
Review access and privileged accounts quarterly; revoke departed personnel's access within 24 hours.
Use unique administrative passwords of at least 16 characters in a password manager. Investigate suspected compromise and rotate affected credentials.
Enforce account/project membership and role permissions on the server. Integration credentials have scoped actions and can be revoked.
Configure SAML SSO for entitled accounts. Document customer identity-provider settings, enforcement and authorized recovery.
Only the workspace owner may change the account AI policy. Team members and clients cannot override it through project preferences.

5. Encryption and network protection

Require HTTPS/TLS 1.2 or later for public application traffic and encrypted service connections.
Verify database TLS and Redis transport in the deployed connection configuration; a URI scheme or former Atlas configuration is not sufficient evidence.
Require protected database, object and backup storage, and document actual at-rest encryption and key recovery. Do not claim an algorithm or enabled setting without verifying it.
Require full-disk encryption on administrative workstations.
Store passwords as bcrypt hashes; enforce appropriate cost settings.
Restrict database and administrative network access with deployment-specific firewall rules and credentials.
Maintain input validation/sanitization, appropriate security headers, rate limits and SSRF protection for outbound fetch/proxy operations.

Self-hosted database encryption, patching, firewall rules and backups are the company's responsibility; Hetzner infrastructure certification does not establish those application-level controls.

6. Workstations and customer evidence

Require full-disk encryption, screen locking, supported OS security updates, firewall/malware protections and a lost-device response process. Prefer approved service infrastructure for customer data. Any authorized local investigation must minimize evidence, restrict access and document deletion; customer information must not be copied into personal accounts or unapproved tools.

Development or local evaluation access to production data remains subject to the same controls as production processing.

7. Application and integration security

Use authenticated and authorized API access, validate/sanitize untrusted input, verify payment webhook signatures, and scan dependencies. Review integration scopes and credentials before activation; signed payment webhooks do not imply every custom integration uses the same verification method.

Customer-configured integrations may export data or change feedback within the granted permissions. Controls reduce risk; the company does not guarantee that an integration compromise can never affect platform or customer data.

The browser application and site widget can be used without installing desktop software. The WordPress plugin, Chrome extension and other platform integrations are optional and must be included explicitly in the customer's implementation scope.

8. AI processing and customer control

Simple Commenter uses AI for the assistant, developer briefs, rewrites and translations (Anthropic), and location suggestions when enabled (TypeSafe). External AI clients can connect through separately authorized MCP/CLI access. Spam pattern matching does not make the whole service AI-free.

Developer briefs are enabled by default at project level when the account permits AI. Their inputs can include comment text, page/element context, device information, screenshots and captured console errors according to settings. Assistant requests include the conversation and authorized tool results. Rewrites/translations use the submitted text and relevant context.

The account AI control in MCP & AI connections → AI access for this workspace applies across existing/new projects and all roles. When disabled:

Built-in provider calls, automatic/queued/manual briefs, rewrites, translations and location suggestions are blocked on the server.
Existing AI/MCP connections and CLI tokens are revoked, new authorization is denied, and saved MCP work is subject to live access checks.
Administrative replay cannot send the account's feedback to AI. Mixed historical analytics research is blocked while an account has disabled AI because those snapshots cannot reliably exclude its data.
Ordinary feedback collection, screenshots and manual collaboration remain available.

Requests already dispatched can finish. Previously generated content and recipient-held copies are not erased by the switch. Re-enabling AI requires reconnecting revoked clients. Other integrations retain their permissions; an AI-restricted implementation must also review customer-selected destinations and any onward processing.

The company does not use customer content to train its own models. Supplier training and retention terms are distinct: Anthropic's commercial API excludes training by default, subject to opt-in/feedback exceptions; TypeSafe states that it does not train on inputs. External AI clients follow their own terms and account settings. No blanket zero-retention or EU-only AI claim is made.

9. Logging, monitoring and incident response

Maintain access-controlled logs appropriate to authentication, API usage, security events and errors. Minimize sensitive payloads and secrets in logs. The existing Better Stack inventory records Nuremberg, Germany, with 365-day retention; the owner must verify that configuration and document any exceptions.

Report suspected incidents immediately to aleksander@simplecommenter.com. Follow the private Incident Response Plan, preserve evidence, revoke compromised access and notify affected customer/controllers without undue delay upon awareness of a personal-data breach. Maintain a breach register and support applicable customer/regulatory obligations.

10. Suppliers and transfers

Maintain an inventory of providers, data purposes, locations, applicable DPAs and transfer safeguards. Review material changes before introducing a provider and notify customers as required by their agreements. Obtain current certification/audit evidence where relevant; GDPR is not a certification, and supplier certification does not certify Simple Commenter itself.

11. Changes, patching and continuity

Track changes in version control and use controlled deployment/review procedures. Production is hosted on Vercel; alternative deployment scripts do not constitute an active standby service. Review database/configuration changes and retain recovery instructions.

Prioritize critical security patches with a target of 72 hours, high-severity patches within 14 days and routine updates within 30 days, recording exceptions and mitigations. Managed providers patch their services; the company maintains its application and self-hosted database/host configuration.

Maintain tested database and file backups and protected recovery access. RPO under six hours and RTO under eight hours are planning objectives pending measured validation; the Business Continuity Plan records dependencies and evidence gaps.

12. Review and accountability

Review this policy at least annually and after material incidents, architecture changes or new processing activities. The owner records approval and maintains operational evidence separately from this technical revision.