Security – technical and organisational measures (Art. 32 GDPR)

Last updated: 2026-11-09

This page describes the measures we use to protect our customers' data. It describes the actual state of the system.

Hosting

Servers at Hetzner Online GmbH in the Nuremberg data centre, Germany. Hetzner's data centres are ISO/IEC 27001 certified (physical access, power, cooling, fire protection).
Backups twice a day, encrypted before upload (age), stored at Cloudflare R2 with an EU location, kept for 30 days. The decryption key is kept separately from the backups.

Encryption in transit: HTTPS (TLS) with HSTS only for all access; connections to CRM systems and phone systems verify the remote certificate.
Server access only with SSH keys, no password login; a firewall lets only the required services through from the internet, management interfaces are reachable over HTTPS only.
Encryption of stored credentials: API keys, tokens and phone system credentials are encrypted with a separate data key per customer (AES-256-GCM); these keys are in turn protected by a master key that is not stored with the data and can be rotated.
Customer separation: each customer's data lives in its own database schema.
Pseudonymisation: phone numbers appear in logs only as an encrypted hash plus the last two digits.
Sign-in: passwords as Argon2id hashes; second factor (TOTP) with recovery codes, mandatory for platform administrators; session cookies HttpOnly, Secure, SameSite=Strict; sign-in attempts are rate limited.
Roles and rights: separate roles for partners, customer administrators and read-only users; API keys are limited to one customer.
Phone systems authenticate with their own credentials per system; replacing them invalidates all previously issued tokens at once.
Protection against misuse of connections: outbound connections go to public addresses only (server-side request forgery protection, also on redirects).
Secrets are never logged; request parameters do not appear in logs; logs are size-limited and continuously overwritten.

A log of all administrative changes with time and acting person.
Validation of all API input; protection against cross-site request forgery.
Every code change passes automatic tests and security checks (secret scanning, static code analysis, dependency checks for known vulnerabilities) before it is shipped.

Backups twice a day (at most about 12 hours of data loss), encrypted and stored off the server.
An additional database backup before every release; the previous version is kept for a quick rollback.
Load limits per customer, so one customer cannot impair the service for others.

Log retention adjustable per customer (default 30 days).
On termination the customer's data key is destroyed; their data can then no longer be read, also in backups, and a restore does not bring it back.

Security incidents are handled by a defined procedure; we inform affected customers without undue delay (Art. 33(2) GDPR) so they can meet their own reporting duties.
Processors are bound by contract under Art. 28 GDPR; the list is in the Trust Center under "Subprocessors".