Version of 14 October 2026

Security and compliance

This page summarises our security measures for public authorities and organisations evaluating scopemy.city. It describes the actual situation, including what remains to be done.

What is in place

• Website, database and photos hosted in Switzerland by a professional hosting provider.
• Encrypted connections over HTTPS, with HSTS.
• Passwords hashed with bcrypt, never stored in plain text.
• Prepared statements for all database access and protection against cross-site request forgery on all forms.
• WhatsApp message signatures verified: an unsigned message is rejected.
• Access to administration restricted by role and by city.
• Security headers (content security policy, no embedding in other sites), internal files not accessible from the web.
• Limits on the number of login attempts and messages.

What is in progress

An internal audit in September 2026 identified issues to fix before any go-live for a public authority. The measures below are developed and tested unless stated otherwise; they will be in production with the next deployment. We update this list at each step.

• Fixing the weaknesses in account management identified by the audit.
• Daily encrypted backup (decryption key kept off the server), off-site copy and monthly restore test.
• Mandatory two-factor authentication for administration accounts.
• Photos re-encoded on receipt, which removes their metadata (including location), and kept outside the public part of the site until published.
• Mandatory automated tests before each release, separate test environment, quick rollback.
• External availability monitoring and centralised error reporting.
• Penetration test by an external provider before the first contract: to be ordered.
• Data in Switzerland: maps and geocoding by swisstopo, already developed; e-mail delivery by a Swiss or European provider: to be chosen.

Where the data is

The database and photos are in Switzerland. Base maps and geocoding come from swisstopo, in Switzerland (as a fallback, geocoding uses OpenStreetMap's Nominatim, in the United Kingdom). WhatsApp messages pass through Meta, including in the United States. E-mails go through a provider whose account data is in the United States. The e-mail and SMS channels, if enabled, use the providers listed on the Subprocessors page.

Who does what

On an authority's instance, the authority is the data controller and we are its processor. We process data only on its instructions, and the contract sets out the security measures, incident notification, audit and return of data.

Documents available on request

For your evaluation, we provide:

• the data processing agreement, with its annexes on technical and organisational measures;
• a pre-filled impact assessment template, with an annex for your cantonal law;
• our security concept, based on the ISO 27001 standard and the Swiss Confederation's minimum ICT standard;
• our support offer: availability, response times, backups and reversibility;
• the current list of subprocessors.

Report a vulnerability

If you discover a vulnerability, write to contact@scopemy.city without making it public. We will acknowledge receipt, fix it and keep you informed.