Information Security and Confidentiality

The platform implements strict data isolation and secure deployments that ensure complete jurisdictional control. Every environment can be operated within European or client-controlled infrastructures, guaranteeing that no sensitive information is transferred or processed outside of approved territories.

To protect classified or restricted environments, Garbo applies internal confidentiality protocols inspired by defense-grade standards. Information is compartmentalized by design and access control follows a role-based (RBAC) structure, and sign-ins and other security-relevant account events are logged and traceable. This ensures accountability without compromising privacy.

The platform’s development and deployment pipelines are governed by Security-by-Design and Privacy-by-Default principles. Secure coding practices and peer review of changes are part of our development workflow, and automated tests run in our CI/CD pipelines before deployment, to minimize exposure and support continuous security evolution.

Garbo’s internal practices are aligned with recognized international frameworks such as the NIST Cybersecurity Framework (NIST CSF) incorporating best practices.

In parallel, all data processing complies with the General Data Protection Regulation (GDPR) and the guidelines of the European Union Agency for Cybersecurity (ENISA). Our operations adhere to the principles of lawful processing, data minimization and explicit purpose limitation.

Through this combination of comprehensive security engineering, Garbo establishes an environment where security is not reactive but inherent, a system designed to operate securely even under classified conditions, ensuring confidence for every client and partner.

---

Security of the Garbo cloud service

Among the measures that protect the Garbo cloud service and its users:

• Two-factor authentication for every account. Signing in always requires a password and a one-time verification code. Users are alerted to sign-ins from a new device, and repeated failed attempts temporarily lock the account.
• Restricted access. Registration is limited to approved users, and members join an organization by invitation and are given a role within it.
• Encrypted connections. All connections between users’ browsers and the platform, including device streaming, are encrypted with TLS.
• Separated devices. Each organization’s virtual devices are kept apart from those of other organizations.
• Private infrastructure. The servers that run virtual devices have no public IP addresses and can only be reached through the platform’s controlled entry points.