Security & Compliance

Square Software is an Albanian company and processes personal data under Albanian Law No. 9887 “On the Protection of Personal Data”, supervised by the Commissioner for the Right to Information and Protection of Personal Data (IDP). Albanian data-protection law is closely modelled on the EU framework, and we engineer our systems so the same controls satisfy the EU General Data Protection Regulation (GDPR) for clients and end-users in the European Union.

In practice that means data minimisation by default, a lawful basis for every processing activity, honoured data-subject rights (access, rectification, erasure, portability), retention limits, and Data Processing Agreements with the clients on whose behalf we process data. When we act as a processor, we follow the controller’s documented instructions and pass equivalent obligations to any sub-processor.

Security is part of engineering, not a separate gate at the end. Our delivery process embeds review and verification at each stage so vulnerabilities are caught early, when they are cheapest to fix.

We build software that has to interoperate with Albanian government systems, so we maintain working knowledge of those regimes rather than treating them as an afterthought. Our team implements fiscalization — the real-time electronic invoicing mandated by the General Directorate of Taxes — including secure handling of fiscalization certificates, signing of invoices, and transmission to the central platform.

For projects that touch e-government infrastructure, we work to the technical and interoperability standards published by the National Agency for Information Society (AKSHI), which governs Albania’s public digital services.

Hosting location is a decision we make with each client, driven by data-residency, latency and regulatory needs rather than a one-size-fits-all default. For clients and end-users in the European Union, we host on EU-based infrastructure from established providers so data stays within the EU/EEA. Where a project requires Albanian data residency, we host accordingly.

Production environments are isolated from development and staging, access is restricted on a least-privilege basis, and backups are encrypted. We document the hosting arrangement and the sub-processors involved as part of each engagement’s Data Processing Agreement.