IAF CertSearch(accredited certificates from participating certification bodies)
Which rules we answer to.
NIS2
eFellows is in scope of NIS2 as an important entity, as a managed security service provider under the Bulgarian Cybersecurity Act. Our notification to the national authority has been filed. Under Article 26 of the NIS2 Directive, managed service and managed security service providers are supervised by the Member State of their main establishment. For eFellows that is Bulgaria, for every service we deliver anywhere in the EU: one supervisor and one set of rules, wherever you are. The security measures of Commission Implementing Regulation (EU) 2024/2690, written for managed service providers, apply to us directly.
DORA
For banks, insurers and other financial entities we act as an ICT third-party service provider under DORA (Regulation (EU) 2022/2554). We have signed DORA terms under Article 30 with financial clients: service description, data location, incident assistance, audit and access rights, exit and termination. We work on your DORA template, and we provide the details your register of information needs on request.
GDPR
For most services we are a processor under Article 28 GDPR; for our own business contacts we are a controller. We sign a data processing agreement with every client whose personal data we process. If a personal data breach affects your data, you hear from us without undue delay and no later than 24 hours after we become aware of it. Our lead supervisory authority is the Bulgarian Commission for Personal Data Protection.
EU AI Act
Where our services include AI systems, we act as provider or deployer under the EU AI Act depending on the engagement, and the contract states which. Agents work under a human oversight line that you set: triage can run with high autonomy, response is approved by a person, containment stays human, and every agent action is logged. ISO/IEC 42001 covers how we manage all of this. It supports AI Act compliance; it does not replace it.
How we protect what you trust us with.
Thirteen areas, in the order of the security measures that EU law sets for managed service providers (Commission Implementing Regulation (EU) 2024/2690, implementing Article 21 of NIS2). The detail sits in our ISO/IEC 27001 Statement of Applicability, available under NDA.
01
Security policy
An information security management system certified to ISO/IEC 27001 since 2018, with policies owned by management and reviewed every year.
02
Risk management
Risks to our services and to client data are assessed and treated under ISO/IEC 27001, and reassessed after every significant change or incident.
03
Incident handling
A documented incident process with severity classes, named roles and evidence collection, and notice to clients in hours (see Incidents).
04
Business continuity
Backups follow the 3-2-1-1-0 rule: several copies, two media, one off-site, immutable copies that ransomware cannot alter, and restore checks with zero errors.
05
Supply chain
Suppliers are assessed before contract, and security is written into every agreement.
06
Acquisition and development
Infrastructure is built as code with peer review and change control; systems are hardened against vendor baselines before they go live.
07
Testing effectiveness
Internal audits, annual certification audits by DNV, annual penetration testing and monthly scanning of internet-facing systems.
08
Cyber hygiene and training
Security awareness training for every employee and regular training of management, as NIS2 requires of the management body.
09
Cryptography
Encryption in transit and at rest, encrypted workstations, and an end-to-end encrypted password manager.
10
Human resources security
Confidentiality obligations for every employee and subcontractor, and documented joining and leaving procedures that open and close access.
11
Access control
Multi-factor authentication for all access, one-time passwords for network devices, and time-bound client access packages approved per client.
12
Asset management
Inventory of systems and configurations, continuous monitoring, and versioned configuration backups.
13
Physical security
Our hardware sits in a data centre with 24/7 guarding, logged access and an obligation to report physical incidents to us within 60 minutes.
If something goes wrong, you hear it from us. Fast.
Notification commitments
Event
Our commitment
Security incident affecting your service or data
First notice within 24 hours of confirmation. Updates at least every 24 hours until contained. Final report within one month.
Personal data breach affecting your data
Without undue delay and no later than 24 hours after we become aware of it (Article 33(2) GDPR).
Financial entities under DORA
First notice within 4 hours of confirmation, so that you can meet your own DORA reporting clock, as set in the DORA terms of your contract.
Our own reporting as an important entity
Significant incidents go to the Bulgarian national CSIRT: early warning within 24 hours, notification within 72 hours, final report within one month (NIS2 Article 23).
We welcome reports from security researchers and treat them seriously. Send your report to security@efellows.bg with the affected system, the steps to reproduce and the impact you see. Please do not include personal data you came across beyond what is needed to show the issue.
In scope. Systems and websites operated by eFellows under efellows.bg, and platforms that eFellows develops and runs.
Out of scope. Systems of our clients (report those to the client), denial of service, social engineering, physical attacks, and findings from automated scans without a demonstrated impact.
What we commit to. We acknowledge your report within 3 business days, give you a first assessment within 10 business days, and keep you informed until the issue is fixed. We ask you to keep the details confidential until a fix is available or 90 days have passed, whichever comes first, and we agree the disclosure date with you.
Safe harbour. If you act in good faith, stay within this policy, avoid harm to data and services and stop as soon as you have shown the issue, we will not take legal action against you. We do not run a paid bug bounty.
