Information security
We protect Customer drawings, specifications and data systematically
The drawings, 3D models and specifications our Customers entrust to us matter to us as much as the parts made from them. That is why we treat information security as part of quality: it has its own policy, responsible people, registers and regular reviews. This page describes what we have put in place — and how to report a security flaw to us.
As of 22 October 2026
-
We have implemented the requirements of the VDA ISA catalogue used in the automotive industry.
-
Although we are not subject to the Polish cybersecurity act (KSC), we apply the ten groups of measures from Article 21 of the NIS2 Directive.
-
Found a security flaw? We will acknowledge your report within 3 working days.
TISAX® – assessment level AL2
TISAX® (Trusted Information Security Assessment Exchange) is the automotive industry’s way of assessing information security and exchanging the results. It is based on the VDA ISA catalogue of requirements and managed by the ENX Association. This allows one assessment result to be accepted by many partners instead of repeating audits at every Customer.
SUNEKO has implemented the TISAX® requirements at assessment level AL2 (Assessment Level 2). At this level an auditor from an authorised audit provider checks the plausibility of the self-assessment: reviewing evidence and interviewing the people responsible for security.
Assessment results and their scope are shared with partners through the ENX portal. If your organisation needs confirmation as part of supplier qualification, write to us — we will provide information on the scope and status of the assessment.
TISAX® is a registered trademark of the ENX Association.
NIS2 – measures we apply voluntarily
The Polish act on the national cybersecurity system (KSC), which implements the NIS2 Directive, covers entities in selected sectors that exceed the size thresholds. SUNEKO is neither an essential nor an important entity within the meaning of that act. We nevertheless apply the risk-management measures of Article 21(2) of the NIS2 Directive — voluntarily, because good practice does not depend on a headcount threshold and supply-chain security matters to our Customers.
-
Risk analysis and security policies (Article 21(2), point a)
Information security policy SUN-ISMS-01 is reviewed at least every 12 months and after any significant change or incident. It also commits us to periodic assessment of the effectiveness of safeguards and to continual improvement of the information security management system.
-
Incident handling (Article 21(2), point b)
Incidents and suspicions must be reported without delay. We keep an incident register that counts down the 24-hour, 72-hour and one-month deadlines, and lessons learned feed back into improving our safeguards.
-
Business continuity and backups (Article 21(2), point c)
Daily encrypted backups with automatic integrity checks, and test restores. We record the results of the tests in the review register.
-
Supply-chain security (Article 21(2), point d)
In line with policy SUN-ISMS-01, we take security into account in purchasing and in working with suppliers. The website uses a minimal number of third-party software components, and we provide their bill of materials (SBOM) on request. The map and the film load only with your consent.
-
Secure development and vulnerability handling (Article 21(2), point e)
The website has a suite of automated tests covering, among other things, sign-in with two-factor authentication, the event log, encryption and forms. We accept reported vulnerabilities under the procedure described below, and our security.txt file follows RFC 9116.
-
Assessing the effectiveness of measures (Article 21(2), point f)
Every day we automatically verify the integrity of the event log, and e-mail alerts to designated people report selected security events (e.g. a new administrator account, a 2FA reset, series of failed sign-ins, a failed backup). We record periodic reviews — accounts, updates, backups, suppliers — in a register.
-
Cyber hygiene and training (Article 21(2), point g)
Passwords of at least 12 characters, rejected when obvious (a list of common passwords, part of the e-mail address), lockout after failed sign-in attempts and automatic sign-out after inactivity. Policy SUN-ISMS-01 commits us to regular staff training.
-
Cryptography and encryption (Article 21(2), point h)
Connections are encrypted with TLS and HTTPS is enforced (HSTS). We encrypt submission content, attachments and backups with AES-256, and store panel account passwords only as hashes.
-
HR security, access control and assets (Article 21(2), point i)
Access follows the need-to-know and least-privilege principles: named accounts, roles, a log entry when a submission’s details are opened, an attachment is downloaded or data is exported, and detection of unused accounts.
-
Multi-factor authentication (Article 21(2), point j)
Every account in the administration panel requires a second factor (a code from an app). Sessions expire after inactivity, and access to the panel can be restricted to selected IP addresses.
This description is for information only: it is neither legal advice nor a declaration of compliance with the KSC act. The technical measures concern this website and its administration panel; the organisational rules derive from the company’s information security management system.
Your data in our forms
Quotation request, contact, report or job application — every form works by the same rules:
- We store submission content and attachments in the panel in encrypted form (AES-256); a copy of each submission is also e-mailed to our office.
- We accept files in selected formats only and check their content before saving.
- Only authorised people can access submissions in the panel, with mandatory two-factor authentication; opening the details, downloading an attachment and exporting are recorded in the event log.
- We delete data in the panel automatically after the periods stated in the information clauses; the periods for e-mail notification copies and for backups are described in the Privacy Policy.
- In submissions we store the IP address only as a hash, and in anonymous reports we do not store even that. IP addresses may appear in the server’s technical logs.
- Analytics and external content (map, film, Facebook) switch on only with your consent.
Are your drawings or documentation confidential? Tick “Confidential documentation” in your request and do not attach files — we will get in touch about a non-disclosure agreement (NDA) and an agreed transfer channel.
Reporting vulnerabilities
If you have found a flaw in the security of this website or our systems, please get in touch. We value responsible disclosure and take it seriously.
We ask that you
- Describe the problem, name the page or resource affected and the steps to reproduce it.
- Do not download, change or delete other people’s data — proof that the flaw exists is enough.
- Do not carry out attacks that disrupt the website (such as denial-of-service) or use social engineering against our staff.
- Give us a reasonable time to fix the issue before disclosing details publicly.
What happens after you report
-
We acknowledge
We acknowledge receipt of your report within 3 working days.
-
We assess and fix
We verify the report, assess the risk and remove the cause. We keep you informed of progress.
-
We say thanks
Once fixed, we let you know and thank you. We take no legal action against people who act in good faith and in line with these rules.
We do not run a bug-bounty programme.
Questions about information security?
During supplier qualification we are happy to answer questions, complete questionnaires and provide the information you need.
Prefer to call? 33 482 30 10