Security & Data Handling

ealytics operates as one team across three locations: senior oversight in New York and Zurich, hands-on delivery in Pristina (Kosovo). We state this openly up front: depending on the engagement, staff of ealytics GmbH (Switzerland) and ealytics LLC (Kosovo) may access the systems and data you entrust to us.

Before an engagement starts, we agree with you which people need which access. You get a named team, and every deliverable passes senior review before it reaches you.

• A data-processing agreement (DPA) under Art. 28 GDPR is available on request before the engagement starts.
• Transfers to Kosovo are covered by the EU Standard Contractual Clauses; for Swiss clients, supplemented by the FDPIC-recognized adaptations.
• Confidentiality agreements (NDAs) with all staff, and with you on request.
• An overview of subprocessors in use is available on request.

• Least-privilege, role-based, per-person access.
• Multi-factor authentication on core work and client systems.
• Encrypted transmission throughout (TLS); credentials are never shared in plain text.
• All access revoked on role change or departure (documented offboarding).
• Wherever possible we work directly in your systems (accounting software, cloud console, ticketing) rather than copying data out — your systems stay authoritative, and bulk exports are not part of our standard approach.
• Access to client systems uses personal, auditable accounts.

Our own website infrastructure (including contact inquiries and visitor statistics) runs on servers in Europe — see the privacy policy for details. Engagement data stays in the systems we agree on. If you need an engagement delivered entirely without access from Kosovo, we will assess that with you before you commit.

We answer procurement, IT-security, and privacy questionnaires as part of contracting. Write to [email protected] — you will hear back from someone accountable, not a queue.