Security and Data Protection

1. European infrastructure

ScoringMy's main infrastructure is hosted by Hetzner Online GmbH in Germany, within the European Economic Area (EEA).

The platform runs on a dedicated server environment hosting the main application components, including backend, frontend and database.

2. Network and communications security

ScoringMy uses HTTPS/TLS connections to protect communications between users and the platform.

Cloudflare is used as a reverse proxy and traffic protection layer. Communications with external services are made from backend systems over protected API connections. Credentials for external services are not exposed to the user's browser.

Artificial intelligence features are also integrated through server-side calls. To find out which AI providers ScoringMy uses and what information each one receives, see our AI Usage and Transparency page.

3. Access control

Access to ScoringMy requires authentication. Permissions are managed at application level through role-based access controls and are designed to limit access to the information and features relevant to each user and organisation.

Administrative access to production infrastructure is restricted to authorised personnel and the principle of least privilege applies.

4. Monitoring and logging

ScoringMy maintains logging and monitoring mechanisms to support anomaly detection, incident investigation, technical diagnostics and the protection of system integrity.

The platform uses observability and technical monitoring tools, including New Relic.

5. Backup and recovery

ScoringMy maintains automated backup procedures designed to reduce the risk of data loss and support service recovery.

Daily backups are performed within the hosting environment, maintaining multiple rotating recovery points and access controls over the backups.

6. Vulnerability management

ScoringMy maintains vulnerability management procedures that include dependency updates, monitoring of known vulnerabilities and application of security patches where necessary.

7. Incident management

In the event of a security incident, ScoringMy applies investigation, containment and mitigation procedures.

8. Privacy and data protection

Data processed

ScoringMy mainly processes professional information needed to provide the platform's features. Depending on the service used, this information may include first name and surname, work email address, job title, company or organisation, public professional profile URL and professional digital presence metrics.

Source of the data

Data may come from the user, from the client company in the context of a professional programme, or from professional information available in publicly accessible sources.

Data protection roles

PeopleXBrand Aceleradora S.L. may act as Controller or Processor depending on the specific context in which ScoringMy is used. When it processes data on behalf of a client company, the corresponding conditions are governed by the Data Processing Agreement (DPA).

Principles applied

ScoringMy applies the principles of purpose limitation, data minimisation, access control and confidentiality. The platform is not designed to process special categories of personal data and users should avoid entering sensitive or confidential information that is not necessary for the purpose of the service.

9. Technology providers

ScoringMy uses specialised technology providers to operate the platform. The relationship between each provider and the processing of personal data is determined by the contracted functionality, the data actually processed and the applicable regulations.

Provider	Purpose	Relevant information
Hetzner Online GmbH	Hosting and main infrastructure	Germany / EEA
Cloudflare	Reverse proxy, traffic protection and network security	Security infrastructure
Brevo (Sendinblue)	Transactional email	Service communications
New Relic	Technical monitoring and observability	Diagnostics and operations

Providers specifically related to artificial intelligence features are detailed on the AI Usage and Transparency page.

10. Security documentation

Documentation available for a more detailed view of ScoringMy's security and data protection measures:

10.1. Security & Data Protection Summary

Executive summary of architecture, data processing and security measures.

1. Service description

ScoringMy is a SaaS platform developed by PeopleXBrand Aceleradora S.L. to visualise and analyse professional digital presence, generate metrics and indicators and assist professionals and organisations in improving their professional positioning and communication.

• visualisation of professional data and metrics
• improvement recommendations and professional benchmarking
• aggregate analysis of digital presence across teams
• AI-assisted generation of text and image content
• semantic analysis of professional posts.

2. Nature and source of the data

ScoringMy processes professional data necessary to provide the service, such as name, email address, job title, organisation, public professional profile URL and digital presence metrics. The platform is not designed to process special categories of personal data.

Data may come from the user, from the client company in the context of the service, and from professional information published in publicly accessible sources.

3. Infrastructure and security

ScoringMy's main infrastructure is hosted at Hetzner Online GmbH, Germany (EEA). ScoringMy applies access controls, encrypted HTTPS/TLS communications, secure credential management, monitoring, backups and logical segregation of data by client.

4. Use of artificial intelligence

ScoringMy integrates third-party artificial intelligence services through APIs. Each provider is used for a distinct purpose:

• Anthropic (Claude): generation and adaptation of professional text content.
• Google (Gemini): generation of images related to the textual content of a post.
• OpenAI: semantic analysis of the text of professional posts.

For Claude, the context may include information optionally provided by the user about positioning, topics, approaches, keywords, communication style, language and value proposition, together with, where applicable, communication red lines defined by the client company.

For Gemini, the textual content of the post is used as context in order to generate an image consistent with that content.

For OpenAI, only the text of the post being analysed is sent, without employee name, email address, profile URL, author or other associated identifying metadata. The analysis may be used to categorise posts, identify references to the company, assess their alignment with communication red lines and classify them within the communication territories defined by the client.

Information sent to AI providers is limited to what the corresponding feature requires, applying data minimisation criteria. Communications with those providers are made from the backend over encrypted API connections.

5. Human oversight and analytics

Text and image content generated through AI is assistive and editable. ScoringMy does not automatically publish content on behalf of the user. The final decision to use or publish content rests with the user.

Semantic analysis outputs are supporting indicators for communication analysis. They are not designed to make automated decisions with legal or similar effects on employees, nor to automatically evaluate their job performance.

6. Technology providers and data protection

ScoringMy uses technology providers for hosting, communications and AI features. Where a provider processes personal data on behalf of PeopleXBrand or the Client, that processing is governed by the applicable contractual terms and data protection mechanisms. Up-to-date details of sub-processors and providers are maintained in the contractual documentation and/or Trust Center.

7. Retention, rights and contact

Personal data is retained for as long as necessary to provide the service and in accordance with applicable contractual or legal obligations. Data subjects may exercise the rights provided by the GDPR through legal @scoringmy. com.

10.2. Security Architecture & Data Protection Whitepaper

Description of infrastructure, security controls, access, communications, monitoring and data protection.

1. Overview

This document describes the security architecture, infrastructure controls and data-protection measures implemented in ScoringMy, including the secure integration of third-party AI services.

2. Infrastructure and Network Security

ScoringMy is hosted on a dedicated server environment provided by Hetzner Online GmbH in Germany. The environment hosts the application backend, frontend and database. External AI integrations are invoked server-side; API credentials are not exposed to the user's browser.

• HTTPS/TLS-protected user communications
• secure server-side API calls to external services
• application-level logical segregation between client environments
• authenticated access and least-privilege principles for production access.

3. AI Integration Security

ScoringMy integrates third-party AI services through controlled backend API calls. Current providers and purposes are:

• Anthropic Claude: professional text generation and adaptation.
• Google Gemini: image generation based on the textual content of a post.
• OpenAI: semantic analysis of post text for communication analytics.

For Claude, the backend may include user-provided professional and communication context such as positioning objectives, topics, approaches, keywords, communication style, language and value proposition, together with optional client-defined communication red lines.

For Gemini, the input is derived from the textual post content so that the generated image is relevant to that content.

For OpenAI semantic analysis, ScoringMy sends only the text of the post being analyzed. Associated employee name, email address, profile URL, author identity and other identifying metadata are not sent as part of that analysis request.

4. Semantic Analysis Purpose

OpenAI-assisted semantic analysis may be used to classify posts into communication categories (including corporate, personal, educational or informational), identify whether a post references the company, assess alignment with client-defined communication red lines, and classify content against communication territories defined by the client.

The resulting indicators support communication analytics. They are not designed to make automated decisions with legal or similarly significant effects on individuals and are not intended as automated employee-performance evaluations.

5. Data Minimization and Confidentiality

ScoringMy applies purpose limitation and data minimization to AI requests. The information sent varies by functionality and is limited to the context required to perform the requested operation. Users are instructed not to introduce sensitive personal data or unnecessary confidential information into AI-assisted features.

6. Human Oversight

Generated text and images are assistive outputs. Users can review and, where applicable, edit generated content before external use. ScoringMy does not automatically publish AI-generated content on behalf of users.

7. Storage, Monitoring and Reliability

Platform data and saved AI outputs are stored within the ScoringMy environment according to product functionality and contractual retention rules. System activity is logged for monitoring, troubleshooting and security. Backup and recovery procedures are maintained to reduce the risk of data loss.

8. Compliance Position

ScoringMy does not develop, train or distribute foundation models. It operates as an AI-enabled application layer integrating third-party services. Its AI-assisted features are designed with human oversight, transparency, purpose limitation and data minimization. Applicable legal classification and obligations are assessed according to the actual intended use and deployment context.

10.3. Security Processes Overview

Description of the main operational security processes.

1. Logging & Monitoring

The platform implements centralized logging and monitoring using New Relic.

• Scope: application activity, system performance, database operations, and errors are continuously monitored.
• Retention: logs are retained within the monitoring platform according to standard configuration policies.
• Review: logs and monitoring dashboards are reviewed on a regular basis to identify anomalies, performance issues, or potential security events.
• Alerting: monitoring tools enable the detection of abnormal patterns, supporting timely investigation and response when necessary.

2. Access Control Model

The platform implements role-based access control (RBAC) with centralized authorization logic.

• Roles: Admin, with full access to platform functionalities, including user management and system configuration; Employee, with restricted access limited to personal data and specific platform features.
• Authentication: access to the platform is restricted to authenticated users. Administrative access is limited to authorized personnel.
• User provisioning & deprovisioning: user access is granted based on business needs and can be modified or revoked at any time.
• Authorization model: permissions are centrally defined and enforced at backend level through a shared authorization system, ensuring consistent access control across all modules.

3. Backup & Recovery

The platform performs automated backups of the production environment using Hetzner infrastructure.

• Frequency: backups are executed daily.
• Retention: multiple backup versions are maintained, providing several recovery points.
• Storage: backups are stored separately from the production environment.
• Restore capability: the system can be restored from backups in case of system failure, data loss, or other incidents, ensuring business continuity.

4. Vulnerability Management

The platform implements multiple layers of protection to mitigate vulnerabilities.

• Preventive measures: use of Cloudflare to protect against web-based attacks (WAF, DDoS, bot traffic) and regular updates of application dependencies and infrastructure components.
• Detection: system monitoring and logging tools help identify anomalies or unexpected behavior.
• Response: identified issues are reviewed and addressed as part of ongoing maintenance and system improvement.

5. High-Level Architecture

The platform architecture consists of the following components:

• Client (web browser)
• Cloudflare (reverse proxy, security, and traffic filtering layer)
• Application backend (hosted infrastructure)
• Database and storage systems

All incoming traffic is routed through Cloudflare before reaching the application servers, preventing direct exposure of the origin infrastructure and providing an additional security layer.

All external requests are routed through Cloudflare, which acts as a reverse proxy and security layer, before reaching the application backend. This ensures that the origin infrastructure is not directly exposed to the internet.

The backend processes application logic and communicates with the database and storage layer, where data is securely stored.

6. Encryption & Data Protection

• Encryption in transit: all communications are secured using HTTPS (TLS 1.2/1.3), enforced through Cloudflare.
• Encryption at rest: data is stored using infrastructure-level security provided by the hosting provider.
• Data segregation: access to data is restricted through role-based permissions, ensuring users can only access their own information. Logical separation is enforced at application level through access control mechanisms.

10.4. Access Control Policy

Access control principles and procedures.

1. Purpose

This policy defines how access to the platform and data is controlled.

2. Access Model

Role-Based Access Control (RBAC). Roles include:

• Admin (full access)
• Employee (restricted access)

3. Authorization

• Permissions are centrally managed.
• Enforced consistently across all modules.

4. Authentication

• Access restricted to authenticated users.
• Administrative access limited to authorized personnel.

5. User Lifecycle

• Access granted based on business need.
• Access can be modified or revoked at any time.

6. Principle of Least Privilege

Users only access the data and features necessary for their role.

10.5. Backup & Recovery Policy

Backup and recovery procedures.

1. Purpose

This policy defines the backup and recovery procedures implemented by ScoringMy to ensure data availability, integrity, and business continuity in case of system failure or data loss.

2. Scope

This policy applies to:

• Production environment
• Application data
• System configurations and infrastructure

3. Backup Strategy

ScoringMy implements automated backup processes to ensure that data is regularly preserved and recoverable.

3.1 Frequency

• Full backups are performed daily.
• Backup processes are automated and scheduled.

4. Storage and Security

• Backups are stored securely within the hosting infrastructure (Hetzner).
• Access to backup systems is restricted to authorized personnel only.
• Backup data is protected using infrastructure-level security controls.
• Production systems are not directly exposed to public access.
• Stored separately from production systems.

5. Retention Policy

• Backup snapshots are retained on a rolling basis.
• Multiple recovery points are maintained to ensure flexibility in restoration.
• Historical backups allow recovery from recent system states.

6. Recovery Capability

ScoringMy backups allow restoration of the system in case of:

• System failure
• Data corruption
• Operational incidents
• Accidental data loss

Recovery procedures enable restoration of the application environment and associated data.

7. Access Control

• Backup access is limited to authorized technical personnel only.
• Access is managed through secure authentication mechanisms.
• Permissions follow internal access control policies.

8. Monitoring and Validation

• Backup processes are monitored to ensure successful execution.
• System logs allow verification of backup activity.
• Any issues detected are reviewed and addressed accordingly.

9. Continuous Improvement

ScoringMy continuously reviews and improves its backup processes to enhance reliability and security as the platform evolves.

10.6. Security Testing & Vulnerability Management Policy

Vulnerability management, updates and security testing.

1. Purpose

This policy defines how ScoringMy identifies, mitigates, and manages security vulnerabilities.

2. Security Approach

Security is implemented using a layered model including:

• Cloudflare protection: Web Application Firewall (WAF), DDoS mitigation and traffic filtering.
• Secure backend architecture: reverse proxy model, no direct exposure of origin infrastructure.
• Access control: role-based access model and restricted access to production systems.
• Infrastructure-level protection.

3. Vulnerability Management

• Application dependencies are regularly updated.
• Security configurations are reviewed periodically.
• Issues are addressed as part of ongoing maintenance.

4. Monitoring & Detection

• Real-time logging and monitoring (New Relic).
• Tracking of system activity, transactions, and anomalies.
• Logs are available for investigation and analysis.

5. Penetration Testing

• Formal third-party penetration testing is not currently performed.
• Security is maintained through continuous internal controls and monitoring.

6. Continuous Improvement

Security practices are continuously reviewed and improved over time, and may incorporate formal third-party security testing (e.g. penetration testing) as part of future enhancements.

11. DPA and contractual documentation

ScoringMy has a Data Processing Agreement (DPA) governing the processing of personal data when PeopleXBrand Aceleradora S.L. acts as Processor on behalf of a client organisation.

Among other matters, the DPA covers the purpose of processing, categories of data and data subjects, Processor obligations, security measures, sub-processors, incident management, assistance with data subject rights, audits, international transfers and the return or deletion of data at the end of the service.

To request contractual or data protection documentation: legal @scoringmy. com

12. Contact

• PeopleXBrand Aceleradora S.L.
• C/ Gregorio Benítez 10, 28043 Madrid, Spain
• Tax ID B-56994916
• Security, Privacy & Compliance: legal @scoringmy. com