Security & Data Protection

Core customer data — database, file storage (photos), auth data and application hosting — is processed exclusively in the EU (AWS eu-central-1, Frankfurt am Main). We additionally use specialist processors based in the USA: Stripe for payment processing (customer email, name, billing address, payment data) and Resend for transactional and marketing emails (recipient email address, mail metadata). These data transfers are covered by the EU-US Data Privacy Framework adequacy decision of 10 July 2023; Vercel, Stripe and Resend are actively DPF-certified. Sentry error logs are processed in an EU data centre (de.sentry.io); because the provider is based in the USA and its data processing addendum does not rule out access from there (for support purposes, for example), this processing is likewise safeguarded by the EU-US Data Privacy Framework and supplementary Standard Contractual Clauses. A complete sub-processor list with purpose, location and transfer safeguard is available in the privacy policy (/datenschutz, German) and the Data Processing Agreement (/avv, German).

Yes. We enter into a Data Processing Agreement pursuant to Art. 28 GDPR with every customer — this applies from first use and therefore also on the free plan. The agreement text is publicly available at /avv (German) and contains technical and organisational measures (TOMs), the complete sub-processor list and the breach notification obligation. You can review the DPA before signing — no hidden clauses.

After cancellation, your data remains available for export for 30 days (CSV/Excel + ZIP of photos). It is then irrevocably deleted from the database, storage and backups. On request we can shorten the 30-day window or extend it for migration projects. Data minimisation is automated — no manual application required.

At the application level, only users within your organisation, filtered by role: managers see team data, field reps see only their own customers and reports. At the database level this is enforced by Row-Level Security (RLS) — even a compromised user account cannot access other organisations. On the provider side, productive database access is performed exclusively by the provider itself — and only for support requests with explicit customer authorisation; support sessions in the application are logged.

GPS location recording is optional and can be disabled in the organisation configuration. It is only captured once at the start of a visit, not in the background. For deployment we provide a DPIA template (Data Protection Impact Assessment under Art. 35 GDPR) that you can use directly for your works council or data protection officer. Disabling GPS only removes automatic address validation — all other features remain available.

In the event of an incident, our breach response procedure applies: (1) internal escalation and forensics within 24 hours, (2) notification to affected customers with specific impacts and recommendations within the statutory 72-hour window under GDPR Art. 33/34, (3) notification to the responsible supervisory authority (State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia — LDI NRW). The notification obligation is contractually binding in our DPA.

All connections run over TLS 1.2 or higher (HTTPS, HSTS enabled). Database contents are encrypted at rest with AES-256. Passwords are never stored in plain text — they are hashed with bcrypt (cost factor 10). Service tokens and webhook secrets are stored in Vercel encrypted environment variables, not in the code repository.

Not directly at this time. Our infrastructure partners are certified: Supabase (SOC 2 Type II via AWS), Vercel (SOC 2 Type 2 + EU-US Data Privacy Framework + ISO 27001:2022), Stripe (PCI DSS Level 1). A separate certification is not cost-effective at our current scale — we rely on the audit results of our partners and a multi-level, internally documented security review process for code changes. A custom penetration test audit can be commissioned on request.