Security

Version 1.0 · Effective 12 July 2026 · Reviewed annually

Eignasaga maintains the maintenance history of properties and processes user data as well as data from public registries. This page describes how we protect it: how users are authenticated, who can see what, how every lookup is logged, and how we respond when something goes wrong.

1. Principles

Confidentiality: data is only accessible to those entitled to it under our access control rules.
Integrity: data is protected against unauthorised changes; professional verifications are personal and traceable.
Availability: the system is hosted with certified providers with built-in backups and fault tolerance.
Traceability: every external registry lookup, property view and admin action is recorded in an append-only audit log.
Minimisation: only the data needed for a defined purpose is fetched, processed and stored.

2. Authentication: no anonymous access

Users authenticate with Icelandic electronic ID (Auðkenni). Every action in the system is therefore traceable to a real, verified individual identified by their national ID number.

Authentication flows are single-use and protected against replay.
Sessions are signed, time-limited, stored in HTTP-only cookies inaccessible to JavaScript, and only sent over encrypted connections.
Contractors verify completed work through the same authentication flow, so a verification is a personal declaration by a professional.

3. Access control: least privilege

Every user, staff member and system component gets only the access its role requires.

Role	Access
Owner	Full access to their own properties: documents, costs, photos, work history.
Delegate	Access to a specific property under a formally registered grant tied to a national ID, with a defined scope (full or view-only). Revocable at any time.
Contractor	Sees and verifies the jobs they are registered for; sees no other property data.
General user	Sees only the limited public view of properties the owner has chosen to open: no documents, no photos, no itemised costs.
Administrator	Administrative access. Every admin view of another person’s property and every admin action is recorded in the audit log.

4. Audit log: who, what and when

Every lookup in external registries (e.g. the property registry), every property view and every admin action is recorded in an immutable audit log: who did what, when, for what purpose and from which IP address.

The log is append-only: entries are never modified or deleted, and no cleanup process touches it.
Viewing or exporting the log is itself logged.
Registry authorities such as HMS can request an extract at any time, by property, user or period.
The log is retained for at least 7 years.

5. Technical security measures

Encryption:all traffic is TLS-encrypted (user–system, system–database, system–external services) and data is encrypted at rest by our hosting providers.
Security headers: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy on every response.
Abuse protection: rate limiting on sensitive endpoints, single-use time-limited verification tokens, and origin validation of authentication flows.
Passwords: never stored in readable form, hashed with bcrypt.
Secrets management:API keys and connection strings live only in access-controlled environment configuration; they never enter the codebase or reach users’ browsers, and are rotated regularly.
Logging: sensitive identifiers such as national ID numbers are masked in system logs.
Change management: all changes go through version control with review before merging.

6. Subprocessors

The system runs on certified subprocessors, with data processing agreements (DPAs) in place with all of them.

Provider	Role	Certification	Data location
Vercel	Hosting and file storage	SOC 2, ISO 27001	Global CDN (EEA/US)
Neon	PostgreSQL database	SOC 2	AWS eu-west-2 (London)
Resend	Email delivery	SOC 2	US/EU
Taktikal	Electronic ID and signatures	Per agreement	Iceland/EEA

7. Data retention

Data is kept for as long as it is needed for the purpose it was collected for, or as long as law or contracts require. After that it is deleted.

Data category	Retention
Audit log	At least 7 years, append-only, regardless of account deletion
User accounts and property data	Until the user deletes them or requests deletion
Data from public registries	Per the data-sharing agreement with the registry authority; redistribution prohibited
Sessions	Until expiry
Rate-limit records	24 hours
Security incident register	At least 7 years

8. Incident response

A formal incident response plan covers every event that threatens the confidentiality, integrity or availability of data. Incidents are classified by severity with defined response times: severe incidents within 1 hour, significant within 24 hours, minor within 5 business days.

A breach likely to put data subjects’ rights at risk is reported to the Icelandic Data Protection Authority without undue delay and within 72 hours (Art. 33 GDPR).
If an incident concerns data from a public registry, the registry authority (e.g. HMS) is informed in parallel, and access is shut off immediately if needed.
Data subjects are informed where there is a high risk to their rights (Art. 34 GDPR).
Every incident ends with a written post-mortem: root cause, timeline and improvements, with the plan updated as needed.

9. Privacy

Personal data is processed in line with Icelandic Act No. 90/2018 and the GDPR: purpose limitation, minimisation, security and accountability. Your rights (access, rectification, erasure, portability) and our processing are described in the privacy policy.

10. Reporting a vulnerability

If you believe you have found a security vulnerability in Eignasaga, please report it privately to eignasaga@eignasaga.is rather than disclosing it publicly. Include steps to reproduce and the affected part of the system. We acknowledge reports within two business days and keep you informed until the issue is resolved.

← Back