Technical and Organizational Measures (TOM) Reference

Technical and Organizational Measures (TOM) Reference

Effective Date: May 19, 2026 Document Version: May 2026 Legally Binding Original Language: English

This TOM Reference describes how PaperOffice documents technical and organizational measures under Article 32 GDPR as part of the Compliance Package. It is incorporated into the legal framework alongside the Master Service Agreement and the Data Processing Agreement Reference.

1. Purpose

1.1 Article 32 GDPR

PaperOffice implements and documents measures appropriate to the risk, including confidentiality, integrity, availability, and resilience of processing systems and services.

1.2 Authoritative Source

The customer-specific TOM is generated on demand through the in-platform Compliance Package generator (Trust Center). The generated PDF is the authoritative version for Customer's records and audits.

This public page provides a live summary of measure categories and titles. Detailed descriptions appear in the generated Compliance Package.

2. TOM Categories

PaperOffice structures TOM documentation using standard GDPR control categories, including:

• Access control (physical and logical)
• Separation control (tenant isolation per Customer account)
• Transfer control (encryption in transit)
• Input control (logging and traceability)
• Availability and resilience
• Order control (processor instructions and sub-processor management)

The live table below is synchronized from the Compliance generator source.

3. Relationship to Other Documents

4. Updates

TOM measures are continuously improved. Updates are reflected in newly generated Compliance Packages. Material changes follow the modification and notification rules in the MSA and DPA.

5. Contact

PaperOffice Enterprise Operations, S.L.U. Privacy: [email protected] Legal: [email protected]

Last updated: May 19, 2026

© 2002–2026 PaperOffice Enterprise Operations, S.L.U. All rights reserved.