Skip to content
aYOUne

Information Security Policy

Information Security Policy

Organisation: tolinax UG (haftungsbeschränkt), Oberhof 4, 83700 Oberhof, Germany — operator of the aYOUne business platform
Status: Approved by the Managing Director and published. Version 1.0, effective 2026-10-14
Owner: Managing Director (Maximilian Hanrieder)
Review cycle: at least annually, after major incidents and after significant changes to the platform

1. Purpose

This policy sets out how tolinax protects the confidentiality, integrity and availability of the aYOUne platform and of the data that customers (tenants) and their end customers entrust to it. It is the umbrella document of the information security programme; the sub-policies listed in section 6 contain the details.

2. Scope

All systems, services, source code, infrastructure, devices and people (employees, contractors, automated agents) involved in developing and operating aYOUne.

3. Security objectives

  1. Strict separation of customer data between tenants.
  2. Access to personal data only for authorised persons with a business need (least privilege).
  3. Encryption of data in transit and protection of secrets at rest.
  4. Early detection of and fast response to security incidents.
  5. Continuous identification and remediation of vulnerabilities.
  6. Compliance with the GDPR and the German Federal Data Protection Act (BDSG).

4. Implemented technical controls (summary)

Area Control
Hosting Google Kubernetes Engine and MongoDB Atlas in the Google Cloud region europe-west3 (Frankfurt, Germany); object storage in europe-west3
Tenant isolation Every record carries a tenant identifier; the shared data-access layer scopes queries to the authenticated user's tenant
Authentication Central authentication service; passwords hashed with bcrypt; second factor via TOTP, YubiKey or WebAuthn/passkeys; account lockout after repeated failed attempts; rate limits on login and second-factor endpoints
Sessions Short-lived access tokens (15 minutes) with rotating, tracked refresh tokens
Authorisation Role-based access control with fine-grained rights per entity and action, enforced on every API route; customer package rights additionally restrict what a tenant may use
Transport security HTTPS only (HTTP redirected to HTTPS) at the public gateway with publicly trusted certificates; HSTS (1 year, including subdomains)
Secrets Third-party credentials stored encrypted in a credential vault (AES-256-GCM; optional end-to-end mode where the server cannot decrypt)
Network Ingress only through a managed service-mesh gateway; internal metrics endpoints blocked from the internet; IP block lists for abusive sources; workload separation via dedicated node pools
Monitoring Prometheus/Alertmanager alerting, dashboards, automatic capture of runtime errors as tracked tasks, public status page
Audit trail Authentication events and API actions logged with user and tenant context
Vulnerability management Recurring security audits with tracked findings and re-verification

5. Organisational controls

  • Security responsibilities are held by the Managing Director, who approves this policy and its sub-policies.
  • Staff and contractors are bound to confidentiality and to the Internal Data Protection Policy.
  • Access rights are granted on a need-to-know basis and removed when no longer needed.
  • Workplace baseline, in force on all company devices and consoles: active anti-malware protection with automatic updates, automatic screen lock, unique strong passwords stored in a password manager, multi-factor authentication on all company, cloud, source-control and database-console accounts, clear-desk and clear-screen practice, no company data on unmanaged storage, current operating system and security updates.
  • Security incidents are handled according to the Incident Response Policy.
  • Suppliers that process personal data are selected with regard to data protection and are bound by data processing terms (for the large infrastructure providers such as Google Cloud and MongoDB Atlas: the providers' standard data processing addenda).

6. Sub-policies

  1. Access Control Policy
  2. Data Classification and Encryption Policy
  3. Network Security and Monitoring Policy
  4. Incident Response Policy
  5. Vulnerability Management Policy
  6. Data Retention and Deletion Policy
  7. Internal Data Protection Policy

7. Compliance and exceptions

Exceptions to this policy require written approval by the Managing Director, a documented risk assessment and an expiry date. Violations may lead to disciplinary or contractual consequences.

8. Publication

This policy and its sub-policies are published on the aYOUne trust page: https://ayoune.com/en/trust (German: https://ayoune.com/de/trust).

Work with this page

Ready-made instructions for your AI tool. Copy, paste, go — the AI fetches the content itself via the address in the text.

Summarise the steps for me The essentials, in the right order.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/information-security-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Summarise the content for me.

- First, in two sentences: what is this about?
- Then the steps in the order I need to take them.
- One line per step, in plain language.
- At the end: what I should have ready beforehand.

Leave out nothing I need in order to actually finish.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Explain what I need this for What it is good for — and when it is worth it.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/information-security-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Explain to me what I need this for.

1. Which problem does it solve? In one sentence, from my point of view.
2. Three typical situations in which it genuinely helps me.
3. When I do NOT need it — that saves me time.
4. What I can do instead if it is not a fit.

Stick to what the source says. Where it gives nothing, say so openly instead
of guessing.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Help me set this up Step by step, asking me as you go.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/information-security-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Walk me through the setup step by step.

- First tell me what I need to have ready (access, data, time).
- Then take me through ONE step at a time. Wait for my "next".
- For each step, say how I can tell that it worked.
- If something goes wrong, ask me for the exact message instead of guessing.

If the instructions leave a point open, tell me so rather than inventing it.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Help me with a problem Narrow down the cause instead of guessing.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/information-security-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Help me narrow down a problem.

- First ask me what I observe and what I expected instead.
- From that, derive the most likely causes consistent with this source.
- For each cause, give me ONE test that confirms or rules it out.
- Order them so the cheapest test comes first.

Do not guess. If the source does not cover the problem, tell me where I should
look next.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
Explain it in plain words No jargon, from the ground up.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/information-security-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Explain the content so that someone without prior knowledge understands it.

- Start with the purpose: why does this exist at all?
- Explain technical terms in half a sentence on first use.
- One everyday comparison where it genuinely holds — none where it limps.
- At the end: the three things worth remembering.

Do not shorten by dropping conditions. A simplification that hides a
prerequisite is a false statement.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.
A checklist to tick off To follow along while you do it.
Read the following documentation by tolinax UG and work with it.

This page: https://ayoune.com/en/docs/security-privacy/information-security-policy.md
The complete collection: https://ayoune.com/en/docs/security-privacy.md

Turn this into a **tick-off checklist** for practical use.

- Exactly one action per item, in the imperative.
- Order it so that no item depends on a later prerequisite.
- Prerequisites and pitfalls as indented sub-items.
- End with an acceptance step: how do I know everything is right?
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
  instead of this snapshot. If not, ignore this point.

Was this article helpful?

👎 No (0)
Leave a comment