Trust Center

Security & Data Protection

Privacy Policy

Our platform processes personal data in accordance with GDPR guidelines. All data is stored exclusively within the EU and encrypted following best practices.

Technical Measures

• TLS 1.2 and 1.3 encryption across all layers
• Database is encrypted in accordance with best practices
• Strong password policy for administrators
• Strong password policy for administrators

Organizational Measures

• Developer training in line with OWASP SCP
• Regular security updates and patches
• Regular penetration tests
• Frequent vulnerability scans
• Code reviews for security-critical changes

Internal access rights: Only authorized personnel have access to personal data – based on the principle of least privilege (need-to-know basis).

Authentication:

• Logically separated admin access
• Secure password policies for all users

Accreditations:

Security Incidents

What happens in an emergency?

• Internal contingency plan for security incidents
• Reporting obligation to data protection authorities within 72 hours (in accordance with GDPR)
• Transparent communication with affected users

Reporting Process

Infrastructure & Data Types

Cloud Infrastructure

The infrastructure is managed by the hosting provider. Updates, configuration, etc. are handled and monitored by the provider.

Data Types

• Personal data: name, email, business phone number and company affiliation
• Audit data: evaluation tables, potential vulnerabilities and recommendations
• No processing of health or financial data

Data Processing Partners

• Hosting in ISO 27001-certified data centers