Security

Every security and compliance artifact for Lovex AB, indexed for procurement, security reviewers, and researchers. This trust center is in active development. Read it as our target security posture, not a finished certification report.

Artifacts

Trust posture
Certifications, regulatory stance, data residency, controls, AI use, retention, and contacts.
/trust
Pre-answered security questionnaire
CAIQ-style answers covering the ~50 most common procurement questions. Linkable into security portals.
/trust/security-questionnaire
Service status
Operational state per component, current incidents, and an RSS feed at /status/feed.xml for compliance-tool subscription.
/status
Vulnerability Disclosure Policy
Reporting channel, response SLAs, severity matrix, in/out of scope, and safe-harbor terms.
/security/disclosure
security.txt (RFC 9116)
Machine-readable contact and expiry. Procurement scanners and security researchers walk this path automatically.
/.well-known/security.txt
Data Processing Agreement
Article 28 GDPR terms, Annex A sub-processors, Annex B technical and organizational measures. Signed counterpart available on request.
/dpa
DPIA summary
Article 35 process and per-activity assessment outcomes, plus the voluntary light-touch DPIA for AI inference.
/dpia
Record of Processing Activities (summary)
Article 30 register — ten controller activities + two processor activities with lawful basis, retention, transfer safeguards.
/ropa
Incident Response Plan (summary)
Severity tiers, 72-hour GDPR Article 33 customer notification, IMY filing path, post-mortem cadence.
/irp
Sub-processors
Category-based list with 30-day change notice. RSS feed of changes at /subprocessors/feed.xml.
/subprocessors

Direct contacts

Security questions, vulnerability disclosure, incident reports. security@lovex.dev — Acknowledged within 1 business day
Privacy, data subject requests, DPO matters. privacy@lovex.dev — Substantive response within 30 days per GDPR Article 12
Legal, contracts, custom MSAs and DPAs. legal@lovex.dev — Acknowledged within 2 business days

What you will not find here

We do not publish certifications we have not earned (no SOC 2 Type II report, no ISO 27001 certificate, no third-party penetration test). When a customer contract is contingent on one of these, we say so up front and discuss timing — email security@lovex.dev with the deal context and we will respond in writing. Honest disclosure beats fabricated badges.