Security and data protection
A register outlives the people who set it up, and it is public work. This page collects, in one place, what protects it and who touches it. It is what we do today, not a wish list — and the privacy policy stays the binding text.
Signing in
Every account is a named person, added by invitation, and every sign-in is checked twice.
Passwords kept as hashes
Passwords are at least ten characters and stored only as argon2id hashes. We cannot read them, recover them or send them to you.
A second step, every time
Each sign-in with a password needs a one-time code: emailed to the account, or generated by an authenticator app for people who set one up. A code lasts ten minutes and allows five attempts. With an app on, nothing is emailed, so a mailbox is no way round it.
Passkeys
People can sign in with a passkey instead of a password and code. Its private key never leaves their device or password manager and is only used after their fingerprint, face or PIN. A passkey only works on mapzaa’s own addresses, so it can’t be phished, and it is refused for anyone required to use single sign-on.
Recovery without a back door
An app comes with ten single-use recovery codes, stored only as keyed hashes. A lost phone means those codes or an administrator’s reset — never a weaker path in.
Single sign-on
Connect Microsoft Entra ID, Google Workspace or another SAML identity provider, and require it for everyone except administrators, who keep password and code as the way back in if the provider breaks.
Invitation only
There is no public sign-up. An administrator invites each person by email, the link expires after 72 hours, and the token is moved out of the address bar the moment it is opened.
Sessions you can see and end
People see their own signed-in devices and can sign out all the others. A browser session ends after seven idle days at the latest, and changing a password ends the other sessions.
People and permissions
Who may do what is decided by the server on every request, not by which buttons a page shows.
Four roles
Viewer, field, editor and administrator, each including the one before. A field worker can update the condition of an asset and add photos but cannot move or delete it; only administrators reach people, the organisation’s settings and the audit trail.
Organisations kept apart
Every query is scoped to the organisation asking. Another organisation’s asset does not return an error you could probe — it is simply not found. Nothing is pooled between municipalities.
An audit trail of every change
Each sign-in and each change is recorded with who did it and when, kept for 180 days and searchable by your administrators. The name stays on the entry even after the person is removed.
Your data
Where it lives, how it is protected on the way and at rest, and how you get it out again.
Hosted in Denmark, inside the EU
The register and the accounts live in one database on a server in Denmark, run for us by Webdock.io ApS. The company behind mapzaa is Swedish.
Encrypted in transit
All traffic uses HTTPS with HSTS, and the dashboard sends a strict content security policy. Cookies are HttpOnly and there are no analytics or tracking cookies.
Secrets are not kept readable
Session, invitation, reset and API tokens are stored only as SHA-256 hashes, so the usable value exists only with its owner. Authenticator secrets are encrypted with a key kept apart from the database.
Backups you can restore from
A consistent snapshot of the database is taken every night and before every update, checked for integrity before it is kept, and stored with Backblaze in Amsterdam, inside the EU. The 30 latest nightly and 14 latest pre-update snapshots are kept. Photos are not part of them: they are stored with Scaleway in Amsterdam, also inside the EU.
Take it with you
The assets table exports exactly what you see as CSV, GeoJSON or KML, and the API reads the whole register. Nothing is held hostage.
When you leave
After an organisation is closed we keep its data for 30 days, so a mistake can be undone, and then delete it permanently. The privacy policy has the full retention table.
Connected systems
A key on a vehicle or a sensor is a credential left out in the open, so the API is deliberately narrow.
Keys belong to the organisation
Administrators create and revoke API keys. Only a hash is stored, the key is shown once, and revoking it stops it at once. A key keeps working when the person who made it leaves.
Read, or report positions
A read key reads. A write key can do one thing: report where an asset is. It cannot create, delete or change an asset, its category, status or fields.
On its own address, with limits
The API answers on api.mapzaa.com, and only there. Requests are rate limited per address and per key, so one integration cannot starve another.
Data protection
mapzaa is a register of street furniture, not of people — but people sign in, and custom fields can hold what you put in them.
Controller and processor
For accounts and this website we are the controller. For what your organisation records in its register, your organisation is the controller and we are the processor.
A data processing agreement
If your municipality needs an Article 28 GDPR agreement, we put one in place. Ask us and we will send it.
If something goes wrong
A personal data breach likely to present a risk is reported to the Swedish Authority for Privacy Protection (IMY) within 72 hours, and affected organisations are told without undue delay.
Who processes data for us
The list is short on purpose. We sell no personal data and share none for marketing.
| Provider | What it does | What it receives |
|---|---|---|
| Webdock.io ApS · Denmark | Hosts the server and the database. | The service’s data, on a server in Denmark. |
| Resend | Sends transactional email: invitations, sign-in codes, verification and password resets. | The recipient’s email address and the message. |
| Cloudflare | CDN in front of this website, the dashboard and the API; handles the connection to them. | A visitor’s IP address and the request itself. |
| Backblaze · Netherlands | Stores our backups: nightly and before every update. | A copy of the database and the service’s files — everything the service holds except photos. |
| Scaleway · Netherlands | Stores photos of assets, in object storage in Amsterdam. | The photos and their thumbnails. They are not part of our backups. |
| MapTiler | Looks up an address for coordinates, or coordinates for an address. | Only the coordinates or the typed address. The call is made by our server, so no visitor IP address reaches it. |
| OpenFreeMap | Serves the map tiles. | The browser’s IP address, as for any image on any page, because the browser fetches the tiles. |
Where a provider processes data outside the EU or EEA, the transfer relies on the European Commission’s Standard Contractual Clauses or an adequacy decision. The privacy policy is the authoritative list.
Questions we are asked most
Can we see a security questionnaire answered?
Yes. Send yours and we will answer it in writing. Ask us.
Is mapzaa certified, for example ISO 27001?
Not today. This page describes what we actually do, and we answer security questionnaires and audits in writing.
Where exactly is our register stored?
In a single database on a server in Denmark, inside the EU. Your assets, categories, fields, photos and logo are in it; nothing of yours is in another organisation’s data.
Can we restrict sign-in to our identity provider?
Yes. Turn on single sign-on and require it, and everyone except administrators must use it. Administrators keep a password and a code as the way back in if the provider is down.
How do we report a vulnerability?
Email [email protected] with “Security” in the subject and what you found. Please do not test against other organisations’ data; the live demo is a safe place to look around.
Need something we haven’t covered?
A questionnaire, a data processing agreement, or a question your security officer has. Tell us and we will answer in writing.