Security and privacy

Application security model

• Restonim uses advanced cryptographic mechanisms to protect data and to control its integrity.
• The data needed to restore the original values are stored on your computer, encrypted with the AES-256-GCM algorithm. In the macOS version, the project key is stored in the system keychain.
• The integrity of documents and data is controlled by, among other things, SHA-256 hashes (a hash function, not encryption) and authenticated encryption of the restoration data.
• Documents are processed locally. The application does not send their content to servers, and working with documents does not require an internet connection.
• An internet connection will be used only to activate and renew the licence — with no telemetry or analytics tools.
• Before export, you review the detected information, and Restonim checks whether any information marked for protection remains in the document.
• A local project event log records, among other things, the date and time of export and the SHA-256 hash of the exported file.

What information Restonim helps protect

• Professional confidentiality

  Information entrusted to members of regulated professions in the course of their work.

• Legal professional privilege

  Information obtained by lawyers in the course of providing legal advice and representation.

• Trade secrets

  Technical, technological and organisational information that has commercial value and is protected by the business.

• Confidential business information

  Contracts, strategies, financial results and counterparty data that should not leave the organisation in readable form.

• Official secrecy

  Information obtained in the course of official duties, for example in public administration and the justice system.

• Personal data

  The GDPR names pseudonymisation as one of the measures for protecting personal data (Articles 25 and 32), but this is only part of what Restonim offers.

Restonim supports the protection of this information, but using it does not by itself ensure compliance with the law or with professional obligations.

Pseudonymisation under the GDPR

The GDPR defines pseudonymisation as processing personal data in such a way that they can no longer be attributed to a specific person without the use of additional information, kept separately and subject to technical and organisational measures (Article 4(5)).

The GDPR names pseudonymisation as an example of appropriate technical and organisational measures (Article 25(1) and Article 32(1)(a)).

Pseudonymised data that could be attributed to a natural person by using additional information should, as a rule, be considered personal data (Recital 26). Pseudonymisation reduces risk, but data protection law still applies.

GDPR text: Regulation (EU) 2016/679 on EUR-Lex (external site).

Limitations and user responsibilities

• The result of pseudonymisation should be checked before the document is shared.
• The information needed for restoration should be protected at least as carefully as the original document.
• The decision to share a document and the assessment of the legal basis remain the user’s.

This website

• Uses no cookies and no analytics tools.
• Does not allow documents to be uploaded.
• Loads no scripts or fonts from third-party servers.
• Stores only your chosen language in the browser — and only after you choose it.
• The waiting list form sends only the e-mail address, the chosen language and the confirmation of consent.
• Applies a strict Content Security Policy.

Details in the privacy policy.

Reporting vulnerabilities

If you notice a vulnerability in the Restonim application or on this website, please contact us at office@restonim.com. Please do not disclose details publicly before we have responded. Contact details for reports are also available in the security.txt file (/.well-known/security.txt).