How we protect access to your data, what we log, and how integrity checks work.
Passwords are stored using the Argon2id algorithm — one of the safest hashing algorithms. The original password cannot practically be reconstructed from the hash.
After login, a session with limited validity is created. The session cookie is HttpOnly and Secure — not accessible from JavaScript.
Check it yourself: DevTools → Application → Cookies → HttpOnly and Secure.
After several failed login attempts, the account may be temporarily blocked. This helps protect against automated attacks (brute-force).
Key forms and server actions are protected against Cross-Site Request Forgery attacks.
Audit records serve transparency — so the organization has an overview of who did what.
IP address and browser identifier are recorded for key administrative actions (login, voting, changes) for security and traceability. This data is not public and serves exclusively for audit purposes.
Documents and attachments are stored outside public access. Download goes through an authorized endpoint — the system verifies membership in the organization that owns the file. The organization logo and banner may have a public address because they appear on the public profile.
Timeline entries can be provided with a cryptographic hash (SHA-256). If the hash matches the content of the entry, the entry has not been changed after saving. This is a technical tool for transparency — it is not a legal certification or official verification.
After signing in you can compare an entry hash on the timeline. That is a technical check, not an official certification.
Verwalt.ch is designed for transparent internal management. Here's how the system works and what to expect.
Platform operator: TimeDeals Pavelka, Berglistrasse 28a, 8180 Bülach, Switzerland (UID: CHE-393.597.780). Contact for data protection: privacy@verwalt.ch