Who is responsible
The customer normally decides why and how its workspace information is used. Cyberstream handles that information to provide Sijital. A service partner works under its own customer engagement and receives only the job-specific access the customer grants. The signed agreement confirms the exact legal roles.
What Sijital does with data
Sijital supports account administration, document storage and retrieval, work routing, reminders, controlled sharing, change history, support, security monitoring, export and deletion. Information can include business contacts, sign-in events, compliance records and supporting documents.
How it is protected
Controls include organisation-level data separation, least-privilege roles, stronger sign-in checks for sensitive actions, private document storage, job-specific grants, recorded activity, encrypted connections, server-only secrets and controlled recovery procedures.
Service providers
Supabase provides the database, authentication and private document storage in Frankfurt. Vercel provides application delivery and runtime services. Any additional email, file-scanning or monitoring provider must be reviewed and recorded before it is activated for customer data.
Location and transfers
The primary database is in Frankfurt. Application delivery and approved support may involve other locations depending on provider routing and authorised personnel. The signed terms must identify the applicable transfer arrangement and any customer-specific residency requirement before customer data is loaded.
Incidents and requests
Cyberstream will maintain an incident contact, preserve relevant records and notify the customer within the time agreed in the signed terms. Requests from individuals or regulators will normally be sent to the responsible customer unless Cyberstream must respond directly by law.
Return and deletion
Each customer agreement must define record retention, backup retention and any legal-hold exceptions. At exit, Cyberstream will provide the agreed export, revoke workspace access and complete verified deletion after the agreed confirmation period, subject to documented legal or security retention needs.