How we protect access to your data, what we log, and how integrity checks work.
Passwords are stored using the Argon2id algorithm — one of the safest hashing algorithms. The original password cannot be reconstructed from the hash.
After login, a session with limited validity is created. The session cookie is HttpOnly and Secure — not accessible from JavaScript.
After several failed login attempts, the account is temporarily blocked. This protects against automated attacks (brute-force).
All forms and actions are protected against Cross-Site Request Forgery attacks.
Audit records serve transparency — so the organization has an overview of who did what.
IP address and browser identifier are recorded for key administrative actions (login, voting, changes) for security and traceability. This data is not public and serves exclusively for audit purposes.
Uploaded files (documents, attachments) are stored outside public access. Download is only possible via an authorized endpoint — the system verifies that the user is a member of the organization to which the document belongs. A direct URL to the file does not exist.
Timeline entries can be provided with a cryptographic hash (SHA-256). If the hash matches the content of the entry, the entry has not been changed after saving. This is a technical tool for transparency — it is not a legal certification or official verification.
Sprav.cz is designed for transparent internal management. Here's how the system works and what to expect.
Platform operator: TimeDeals Pavelka, Berglistrasse 28a, 8180 Bülach, Švýcarsko (UID: CHE-393.597.780). Contact for data protection: privacy@sprav.cz