← Back to home

Legal Center

Hurus legal documents and policies

Security Policy

Last updated: March 2026 · Hurus AI Systems, S.L. · info@hurus.io

1 Commitment to security

Courtesy translation. In case of any discrepancy, the Spanish version prevails.

Hurus AI Systems, S.L. adopts appropriate technical and organizational measures to ensure a level of security appropriate to the risk in the processing of personal data and its clients' confidential information, in accordance with Article 32 of the GDPR and the principle of data protection by design and by default (art. 25 GDPR).

Security is a continuous process. Hurus periodically reviews and updates its security measures to adapt them to the evolution of the technological and regulatory environment.

2 Technical measures

——Access control: access to systems, data and work environments is restricted to personnel with a justified, legitimate need, through secure authentication and credential management.
——Encryption in transit: all communications with external platforms and services take place over encrypted connections (TLS/HTTPS protocol). Sensitive data is not transmitted over unencrypted channels.
——Credential management: Hurus uses corporate password managers and unique credentials per service. The use of shared or weak passwords is prohibited.
——System updates: systems and tools are kept up to date with the available security patches, minimizing exposure to known vulnerabilities.
——Separation of environments: each client's data is managed in separate environments. Data is not mixed between different projects or clients.
——Backups: regular backups of critical information are made, in accordance with the retention periods set out in the Privacy Policy.

3 Organizational measures

——All Hurus personnel with access to client data are subject to contractual confidentiality obligations of indefinite duration.
——External providers that process data on behalf of Hurus are bound by data processing agreements under art. 28 GDPR, with security obligations equivalent to Hurus's own.
——Hurus does not share client data with unauthorized third parties, nor use it for purposes other than the provision of the contracted service.
——Access to clients' confidential information is granted under the principle of least privilege: each person accesses only what is strictly necessary for their role.

4 Security incident management

Hurus has an internal incident management protocol. If a security breach affecting personal data is detected:

——The Spanish Data Protection Agency (AEPD) will be notified within a maximum of 72 hours of becoming aware of it, where required by art. 33 GDPR.
——Affected data subjects will be informed without undue delay where the breach poses a high risk to their rights and freedoms, in accordance with art. 34 GDPR.
——The affected Client will be informed as soon as possible in order to coordinate the necessary response.
——The incident, its causes, scope and the corrective measures adopted will be documented internally.

5 External providers and third parties

Hurus selects only external providers that offer sufficient security guarantees in accordance with the GDPR. All are bound by data processing agreements (art. 28 GDPR) with obligations regarding security, confidentiality and incident notification. Hurus is not responsible for the security practices of third parties with which the Client has direct relationships outside of Hurus.

6 Client responsibility

The Client is responsible for the security of its own systems, access credentials and internal environments. Hurus assumes no liability for security incidents originating in the Client's systems or arising from the Client's failure to follow good security practices.

Important notice: Hurus will never ask the Client for passwords, access credentials to its private accounts or bank details by email or through unverified channels. If you receive a suspicious communication in Hurus's name, notify us immediately at info@hurus.io.