INFORMATION PROTECTION AND SECURITY STANDARDS

Cloud Architecture

Physical Security

The Forma Cloud Services relies on AWS who is responsible, in accordance with the AWS Shared Responsibility
Model (available at https://aws.amazon.com/compliance/shared-responsibility-model), for implementing controls for
the physical security of data center facilities, backup media, and other physical systems, providing comprehensive and
state-of-the-art security capabilities (available at https://aws.amazon.com/compliance/data-center/controls).

Forma Farm ensures that such physical security controls provided by AWS for its data center include:

Access is restricted by using an electronic key card and/or biometric system, which is unique to each individual.
CCTV is present on all access and exit doors, and recordings are stored for at least thirty 30 days.
Access areas to the building are guarded by security on a 24/7 basis, 365 days a year, either by internal or externalstaff. An intruder alarm is in place for all building access points to detect and alert against unauthorized entry.
Access to the location of the servers and network components that deliver Services, i.e., servers, dialers, switches,routers, firewalls, etc., are restricted to authorized personnel only and adequately logged.

Backup

Backup Policies

Daily Backup

Automatically runs at 5:00 AM UTC
Retention: 7 days

Weekly Backup

Automatically runs on Saturdays at 5:00 AM UTC
Retention: 4 months (120 days)

Monthly Backup

Automatically runs on the first Saturday of the month at 5:00 AM UTC
Retention: 3 years (1095 days)

Backup Status

Last 30 daily backups: All successfully completed (latest: 11/14/2025 at 6:00 AM)
Active monitoring with automatic notifications in case of failure
58 Aurora snapshots available for the db-1-aurora database
180 total recovery points available on AWS Backup

Access Control

Backup access limited via specific IAM roles
MFA required for critical operations
Service Role: AWSBackupDefaultServiceRole with minimal permissions
Full audit trail on AWS CloudTrail

Data storage and Localization

Geographic Location

Primary Location: AWS eu-west-1 (Dublin, Ireland)
All data and backups remain within the European Union (GDPR compliant)
No data transfer outside the EU

Redundancy

Multi-AZ Architecture (3 independent Availability Zones)
Backups are automatically replicated across multiple AZs
Storage: AWS EFS and Amazon Aurora with synchronous replication

Backup Vault

Dedicated vault with automated lifecycle management
AWS default vault for Aurora snapshots
Access controlled via IAM roles with the least privilege principle

Data Encryption

Encryption at Rest

Algorithm: AES-256 via AWS Key Management Service (KMS)
Encryption enabled by default on all Aurora databases
Snapshots automatically encrypted with the same key as the source database

Encryption in Transit

TLS 1.2+ for all application connections
Database connections forced over SSL/TLS
Backup transfer managed internally by AWS over an encrypted private network

Monitoring

The infrastructure is equipped with the following service monitoring procedures and mechanisms:

Server log: All accesses and errors are logged on individual server machines (frontend and database) and the load balancer (aggregated across all machines connected to the service).
Email pre-alerts when peak thresholds are exceeded (CPU usage, number of DB connections).
Uptime Robot: Domain monitoring. If the site is unresponsive, the team is notified via email and internal communication channels (Slack).
Automatic application error notification: Any errors generated by application functionality on the server are notified to the support team.
Monitoring and multi-channel alert system: The difference between available and utilized resources (CPU and RAM) is continuously monitored. When preset thresholds are exceeded, the system triggers autoscaling and communicates the event via various channels to technical staff.

Disaster Recovery

RPO (Recovery Point Objective): 5 minutes

Database: Aurora maintains continuous incremental backups every 5 minutes for point-in-time recovery
File System: 24 hours (automatic daily backups)
Maximum database data loss is limited to the last 5 minutes of operation

Data RTO (Recovery Time Objective): 72 hours

Contractually guaranteed time for complete recovery in a full disaster recovery scenario
Includes: database restore, instance startup, application integrity check