Plattformsicherheit

1. Infrastructure and Hosting

The infrastructure is built on the following components:

• Database: Azure SQL Database with local redundancy (LRS) and automatic failover. Data never leaves the Italian region.
• Web application: Azure App Service deployed across multiple availability zones for high availability.
• Storage: Azure Blob Storage with at-rest encryption using Azure-managed keys (AES-256).
• CDN and DDoS protection: Azure CDN with Azure DDoS Protection Standard to mitigate volumetric attacks.

Microsoft Azure data centers hold ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3 certifications and are GDPR compliant. Details are available at the Microsoft Trust Center.

2. Data Encryption

3. Authentication and Access Control

3.1 Two-factor authentication (2FA/MFA)

Stay supports two-factor authentication for all user accounts. 2FA is strongly recommended for accounts with administrative roles and can be made mandatory at the property level by the account administrator.

3.2 Role-based access control (RBAC)

The platform implements a granular permissions system based on roles. Each user accesses only the features and data necessary for their role (front desk, housekeeping, administration, etc.), following the principle of least privilege.

3.3 Session management

• Sessions expire automatically after a configurable period of inactivity;
• Session tokens are generated with cryptographically secure entropy;
• Logout terminates the session on both client and server side;
• CSRF protection via anti-forgery tokens on all forms.

3.4 Internal administrative access

Overcore developers and administrators accessing production systems are required to use mandatory MFA, a dedicated VPN, and are subject to periodic permission reviews. All access is logged in immutable audit logs.

4. Network Security

• Firewall and Network Security Groups: inbound and outbound traffic is controlled by network-level firewall rules (Azure NSG) allowing only necessary ports and protocols;
• Network segmentation: infrastructure components (application, database, storage) operate in separate subnets with mutual access restricted to the minimum necessary;
• DDoS protection: Azure DDoS Protection Standard automatically mitigates volumetric and protocol attacks;
• HTTP security headers: the Service implements security headers including HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options and Referrer-Policy.

5. Application Security

5.1 Secure development lifecycle (Secure SDLC)

• Code changes are subject to mandatory code review before merging to production;
• Third-party dependencies are monitored for known vulnerabilities (CVE) using automated tools;
• Production deployment occurs through a CI/CD pipeline with automated security checks.

5.2 OWASP Top 10 protection

• SQL Injection: exclusive use of parameterized queries and ORM (Entity Framework Core); no SQL concatenation;
• XSS: automatic output encoding in Razor, restrictive Content-Security-Policy;
• CSRF: anti-forgery tokens on all POST forms;
• Broken Authentication: secure session management, brute-force protection with rate limiting and CAPTCHA;
• Sensitive Data Exposure: no sensitive data in logs, HTTPS everywhere, no caching of confidential data;
• Security Misconfiguration: hardened production configuration, generic error pages that do not expose technical details.

6. Backup and Disaster Recovery

7. Monitoring and Incident Response

7.1 Continuous monitoring

• 24/7 monitoring of application availability and performance;
• Centralized logging of all access events and critical operations;
• Automated alerts for anomalies in access patterns, repeated authentication failures and suspicious behavior;
• Audit logs are immutable and retained for a minimum of 12 months.

7.2 Security incident management

In the event of a data breach, Overcore follows these procedures:

• Detection and containment of the incident as quickly as possible;
• Notification to the supervisory authority within 72 hours of discovery, where the breach is likely to result in a risk to the rights and freedoms of individuals (Art. 33 GDPR);
• Notification to affected Customers without undue delay, including the nature of the breach, data involved and measures taken (Art. 34 GDPR);
• Documented post-mortem with root cause analysis and corrective measures implemented.

8. Payment Security

Billing information (name, address, VAT number) required for invoice issuance is stored in Overcore's systems in encrypted form, separately from any payment data.

9. Vendor Security Management

• Security controls are assessed before onboarding any new vendor with access to sensitive data;
• Contractual agreements including security obligations and Data Processing Agreements (DPA) are executed with all data-processing vendors;
• Key infrastructure providers (Microsoft Azure, Stripe) maintain industry security certifications (ISO 27001, SOC 2, PCI-DSS);
• Vendor access to Overcore systems is reviewed periodically.

10. Personnel Security

• All personnel with access to sensitive data undergo periodic training on information security and data protection;
• Access to production systems is granted on a least-privilege basis and promptly revoked upon termination of employment;
• Staff are bound by non-disclosure agreements (NDAs) and contractual confidentiality obligations;
• Company workstations are protected by full-disk encryption, antivirus and centralized patch management.

11. Vulnerability Disclosure Program

How to report: send an email to security@overcore.it including:

• Detailed description of the vulnerability;
• Steps to reproduce the issue (proof of concept);
• Estimated potential impact;
• Any supporting screenshots or files.

Overcore's commitments:

• Acknowledge receipt of the report within 5 business days;
• Provide updates on remediation progress;
• Not pursue legal action against researchers acting in good faith in accordance with these guidelines;
• Publicly acknowledge the researcher's contribution (upon their request) once the vulnerability has been resolved.

Rules of engagement (Responsible Disclosure):

• Do not access, modify or delete other users' data;
• Do not conduct denial-of-service (DoS/DDoS) attacks;
• Do not publicly disclose the vulnerability before Overcore has had reasonable time to remediate it (coordinated disclosure — typically 90 days);
• Limit testing to your own accounts or dedicated test environments.

12. Shared Responsibility Model

13. Security Contact

For security reports, inquiries about our controls, or Data Processing Agreement (DPA) requests:

For urgent requests related to an ongoing security incident, include in the email subject: [SECURITY INCIDENT].