Security Policy

1. Introduction

Electronic COC is designed to support operational eCoC workflows that may involve vehicle information, approval references, XML files, VECTO files, signing preparation, workflow records and uploaded documents. The purpose of this Security Policy is to describe the security principles and responsibility boundaries that guide the platform.

2. Security Principles

Electronic COC applies security practices intended to support confidentiality, integrity, availability, accountability, least privilege and operational visibility. Security is considered throughout preparation workflows, validation workflows, signing workflows and delivery-related workflows rather than as a separate afterthought.

3. Information Types Protected

The platform may protect information needed for manufacturer-side eCoC operations. The exact information handled depends on the customer configuration, workflow scope and agreed integrations.

• Vehicle information and approval references
• XML files, VECTO files and eCoC-related records
• Workflow information, account information and user activity records
• Uploaded documents and operational preparation records
• Integration-related information from ERP systems, API connections or customer-approved sources

4. Access Management

Access management is based on controlled permissions, account security, role-based access and operational oversight. Customer administrators and authorized users remain responsible for granting appropriate access, protecting credentials and removing access when it is no longer required.

5. Security Controls

Electronic COC uses high-level security controls appropriate to the platform context. These may include authentication controls, access controls, monitoring, operational safeguards and secure development practices. This policy does not disclose detailed infrastructure architecture or sensitive implementation details.

6. Platform Operations

Platform operations are supported by security review practices, monitoring philosophy, operational oversight and incident awareness. Operational records and workflow activity are intended to support accountability and review where appropriate.

7. Third-Party Dependencies

Electronic COC may rely on cloud providers, infrastructure providers, eIDAS providers, integration partners, ERP systems, API connections or other third-party services depending on customer configuration. Electronic COC is responsible for its own services and agreed controls, not for independent third-party systems, decisions or outages.

8. Incident Management

Potential security incidents are handled through detection, assessment, response and communication procedures appropriate to the event. The timing, scope and format of communication may depend on the nature of the incident, legal requirements, contractual commitments and technical feasibility. This policy does not create guaranteed response times unless separately agreed in writing.

9. Customer Responsibilities

Customers remain responsible for account security, credential protection, internal user permissions, data accuracy and lawful use of the platform. Customers also remain responsible for approval acceptance, XML acceptance, EUCARIS acceptance, NAP acceptance and regulatory compliance.

10. Limitations

Electronic COC does not guarantee uninterrupted availability, absolute security, prevention of all incidents or prevention of all third-party attacks. Security measures are based on commercially reasonable efforts and are subject to the responsibility boundaries, exclusions and limitations defined in applicable agreements.

11. Continuous Improvement

Security practices, platform safeguards and operational controls may evolve over time as workflows, technology, customer requirements and risk conditions change. Changes may be introduced to improve protection, reliability, maintainability or operational clarity.

12. Contact Information

Security questions may be sent to info@electroniccoc.eu. Contractual notices, security questionnaires, audit requests or customer-specific security communications may require additional formal channels defined in the applicable agreement.