Legal

Security Standards

We describe our security posture the way it actually is — split into what's live today and what's planned — because overstating security measures is worse than not having them.

Last updated: 21 September 2026

On this page 1. Currently in place 2. Planned (portal build-out) 3. Data handling practices 4. Reporting a concern 5. Contact

1. Currently in place

  • Website infrastructure hosted on Hostinger Cloud, with standard platform-level protections including DDoS mitigation and TLS/HTTPS encryption in transit for all site traffic.
  • Contact form protected by honeypot fields and server-side validation, reducing spam and automated abuse.
  • Source code held under version control in a private Git repository, deployed via SSH key-based authentication — no shared or reusable passwords for site administration.
  • All site administration access requires SSH key authentication; no plaintext credentials are stored or transmitted for deployment.

2. Planned (as our client portal is built)

The measures below are scoped and planned as part of our portal build-out, not yet live:

  • Bunny Shield (Web Application Firewall / bot mitigation) at the network edge
  • FriendlyCaptcha or equivalent on public-facing forms handling sensitive submissions
  • Role-Based Access Control (RBAC) distinguishing admin, researcher, and client permission levels
  • Password hashing via Argon2id
  • Session hardening — secure, HttpOnly, SameSite cookies, with session timeout and rotation
  • Two-factor authentication (2FA) for portal accounts
  • CSRF protection on all state-changing portal actions
  • Audit logging of access to client data within the portal
  • Content Security Policy (CSP) headers to mitigate cross-site scripting risks

3. Data handling practices

  • Respondent data collected during fieldwork is handled per the specific study's data processing terms, agreed with the commissioning client before fieldwork begins.
  • We do not store payment card data. Billing is handled through a third-party payment processor, which maintains its own PCI-DSS compliance independent of Signava's own systems.
  • Backup and disaster-recovery procedures are being finalized as part of our infrastructure setup; this page will be updated once those procedures are confirmed.

4. Reporting a security concern

If you believe you've found a security vulnerability in our systems, please contact us before any public disclosure so we can investigate and respond.

5. Contact

Signava, MB
V. Nageviciaus g. 3, Vilnius, LT-08237, Republic of Lithuania
consult@signava.expert

See also our Privacy Policy and Terms & Conditions.