attachmentAV API (SaaS): Security
Close attack vectors and increase application security by adding virus and malware protection powered by attachmentAV API (SaaS).
ISO 27001 and GDPR compliance (#)
First of all, we are ISO 27001 certified and GDPR complaint.
Here is an exceprt, of our security controls.
- Transmission Confidentiality: We have set up processes to utilize standard encryption methods, including HTTPS with the TLS algorithm, to keep transmitted data confidential.
- Encrypting Data At Rest We have set up cryptographic mechanisms to encrypt all production databases and storage systems that store customer data at rest.
- Centralized Collection of Security Event Logs: Our infrastructure is configured to generate audit events for actions of interest related to security for all critical systems.
- Vulnerability Remediation Process: We identifiy vulnerabilities on the Company platform through the execution of regular vulnerability scans.
For more details about our security policies and controls as well as the certificates, please visit our trust center.
Jurisdiction/Region (#)
attachmentAV API (SaaS) processes data in the jurisdiction/region of your choice. We support:
https://eu.developer.attachmentav.com/v1/(Europe, default)https://us.developer.attachmentav.com/v1/(United States)https://canada.developer.attachmentav.com/v1/(Canada)https://india.developer.attachmentav.com/v1/(India)https://australia.developer.attachmentav.com/v1/(Australia)
We guarantee, data sent to an API endpoint does not leave the jurisdiction/region.
There is one execption to this rule, we use the Sophos SXL Live Protection feature to significantly increase the accuarcy of the virus and malware detection. This causes lookup requests from our infrastructure to endpoints operated by Sophos. The lookup requests do only contain a hash of the scanned file. The lookup requests are routed to one of the Sophos endpoints in the following regions based on latency: US, Ireland, Germany, India, Japan, Australia. We do not have control over the latency-based routing algorithm and therefore cannot 100% guarantee, that lookups will not reach a region different from our API endpoint.
Are you required to ensure data processing in another region of the world? Let us know!
Access to our system only granted to support, administrative or security personnel from EU.
Protecting data in transit (#)
attachmentAV encrypts data in transit as illustrated in the following figure.
- Client sends file to attachmentAV API: HTTPS/TLS
- Backend downloads file (optional): HTTPS/TLS
- Backend sends scan result callaback URL (optional): HTTP/TLS
Protecting data at rest (#)
To be able to scan files for viruses, trojans and other kinds of malware, attachmentAV temporarily persists data.
- attachmentAV recieves or downloads the file.
- attachmentAV temporarily stores the file on an encrypted volume.
- attachmentAV calls the Sophos engine to scan the file.
- attachmentAV deletes the file.
- attachmenAV returns the scan result.
We use encrypted volumes to ensure confidentiality of the temporary data.
Besides that, we store the following data.
| Data Storage System | Description | Encrypted-at-Rest | Data Retention |
|---|---|---|---|
| Message Queuing | The API creates jobs for all asynchronous scans (/v1/scan/async/download and /v1/scan/async/s3 and sends them to a message queuing system. All data submitted via the API request are getting stored temporarly. | Yes | Deleted after scan job suceeded or failed. Hard data retention limit is 14 days. |
| Database | The scan result of asynchronous scans (/v1/scan/async/download and /v1/scan/async/s3) get stored in our database when no callback_url was provided during the API request. The scan result contains the trace_id, the malware name and description, as well as the file size, and file type. | Yes | 24 hours |
| Database | The callback failures of asynchronous scans (/v1/scan/async/download and /v1/scan/async/s3) get stored in our database when a callback_url is defined but attachmentAV could not deliver the scan result due to an error. The callback failure includes the download URL, the scan result, as well as the error. | Yes | 30 days |
| Log Management System | Access logs from the load balancer including the IP address, path, and status code. | Yes | 30 days |
| Log Management System | Network connection logs including source and destination IP addresses and ports. | Yes | 30 days |
| Log Management System | Application logs including details about asynchronous scans. | Yes | 30 days |
Sub-Processors (#)
- Amazon Web Services (AWS): Services in the field of the provision of information technology infrastructure and related services (e.g. storage space and/or computing capacities); Service provider: Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, 1855, Luxembourg; Website: [https://aws.amazon.com/]; Privacy Policy: [https://aws.amazon.com/privacy/]; Data Processing Agreement: [https://aws.amazon.com/compliance/gdpr-center/]. Basis for third-country transfers: EEA - Data Privacy Framework (DPF), Standard Contractual Clauses ([https://aws.amazon.com/en/service-terms/]).
- Sophos: Virus and malware detection engine; Service provider: Sophos Limited, The Pentagon, Abingdon Science Park, Abingdon, Oxfordshire OX14 3YP, United Kingdom; Website: [https://sophos.com]; Privacy Policy: [https://sophos.com/privacy/]; Data Processing Agreement: [https://www.sophos.com/en-us/legal/data-processing-addendum]; Basis for third-country transfers: Art. 45 GDPR – Commission adequacy decision for the United Kingdom (originally Implementing Decision (EU) 2021/1772, renewed 19 December 2025, valid until 27 December 2031).