Our security
How we protect this website and the data you send us through it. We only write here what we have verified ourselves.
Transport and the website
All communication with the website is encrypted (HTTPS); unencrypted HTTP is redirected. The website uses no third-party analytics or advertising tools and loads no scripts from other servers. We send the browser rules that define where the page may load content from (Content Security Policy).
Data from forms
An enquiry, a course registration or a test result is stored on our server and sent to us by e-mail through our own mail server (SPF, DKIM and DMARC configured).
Retention periods are in the privacy notice; once they expire, records are deleted automatically, every day. We send visitors nothing they have not asked for.
Backups
The server is backed up daily to encrypted storage outside the server; we keep backups for at most 12 months, as the privacy notice states. We test restores — most recently the whole website on 22 September 2026 at a standby location, and a single file on 19 September 2026.
Operation
The data are processed on server hardware owned by IOSEC Slovakia s. r. o., located in the Slovak Republic — on the premises of the data centre operated by Lombard s. r. o., Školská 14, 921 01 Piešťany, which provides connectivity and physical housing for the equipment. This is a lease of space and connectivity for our own hardware: the data centre provider has no access to the data stored on that hardware and does not process personal data for us. Security patches are installed on an ongoing basis. Server logs are kept for at most ten days.
Reporting vulnerabilities
If you have found a vulnerability in our website, write to security@iosec.eu. We will confirm receipt and get back to you when we have a result. Please do not download other people's data, do not test service availability and do not use social engineering. We do not pay rewards; if you wish, we will name you here once the issue is fixed. Machine-readable contact details are in /.well-known/security.txt (RFC 9116).
What you will not find here
Claims we have not verified. We add to this page when we measure or rehearse something — not in advance.
Status verified as of 15 September 2026.
Tell us what you are dealing with.
Thirty minutes with a consultant who knows your industry. The output is a one-page summary with a recommended approach and an indicative scope — we send it to you even if we do not reach an agreement.