Security Policy

This is a translation of the Spanish Política de seguridad. If there is any discrepancy, the Spanish version prevails.

Institutions and musicians entrust Weikos with personal, employment and financial information. Protecting it is part of the product, not an add-on. This page summarises how we do it and how to tell us if you find a security problem.

Last updated: 11 November 2026.

Our commitment

We are implementing an information security management system in line with ISO/IEC 27001 and the Spanish National Security Framework (ENS), with the aim of certifying it in 2027. We review the measures whenever the product changes, and every new feature decides from its design who can see and change each piece of data.

How we protect information

• Encryption in transit using TLS for all communications with the platform.
• Encryption at rest of the database and stored files, with AES-256 encryption managed by the infrastructure.
• Additional field-level encryption for the most sensitive information: identity document number, Social Security number, date of birth, postal address, bank accounts (IBAN and SWIFT/BIC) and tax identification.
• Role-based access control: each person can access only the information that corresponds to them according to their role and their relationship with the institution. Institutions can adapt the roles to their organisation.
• Activity log: the platform records who creates, changes, exports or deletes information, so the institution can review it.
• Automatic database backups, with point-in-time recovery, and file versioning so that accidental deletions can be reversed.
• Vulnerability reviews of the third-party dependencies used in the platform.
• Providers that offer sufficient guarantees for the protection of data, with the corresponding data processing agreements.

Where the data is

The platform information—database and files—is stored on Amazon Web Services servers in the Frankfurt region (Germany), within the European Union. Details of the providers involved are in our Privacy Policy.

How to report a security problem

If you think you have found a vulnerability in weikos.io, the platform or the apps, write to us at security@weikos.io. We ask you to:

• Tell us what you found and how to reproduce it, in as much detail as possible.
• Not access, change or delete information that is not yours, nor disrupt the service.
• Give us reasonable time to fix it before making it public.

We will reply as soon as possible, keep you informed about the fix and thank you for the report.

If you think your account has been compromised

If you have reason to believe that someone has accessed your account without authorisation or that your credentials have been exposed, change your password and write to us immediately at security@weikos.io.

Emails pretending to be from Weikos

We will never ask you by email for passwords, access codes or bank details. If you receive a message doing so on behalf of Weikos, do not reply or open its links, and forward it to security@weikos.io.