Security and privacy
This is what we do and what is not finished yet. Where something is open, we say so.
Where the data lives
The cloud runs at Hetzner in Germany. You conclude the data processing agreement under Art. 28 GDPR when you register (DPA).
Receipt recognition: please read carefully
Data is stored in the EU. The optional receipt recognition runs through Anthropic (USA). It is off by default and only active if you switch it on. Only the receipt image and a fixed prompt are sent, no names, personnel numbers or company data. Sick notes never enter this pipeline. The legal basis for the transfer to the USA still has to be clarified; that is why we do not say “all data stays in the EU”.
Push notifications
Push goes through Apple and Google and contains no content, only a signal with an encrypted identifier.
Pentest
An independent penetration test is planned and has not been carried out yet. Until then the measures above apply, without external confirmation.
Security measures with status
| Topic | What it means | Status |
|---|---|---|
| Tenant separation | Every business table carries a tenant ID and row-level security in the database. Every query runs with tenant context; the service role is used server-side only. | In place |
| Sensitive fields | IBAN, social security number, tax ID, salary and connection credentials are stored encrypted only. Every access is logged. | In place |
| Sign-in | No passwords of our own where SSO or passkeys are possible. A second factor (MFA) is mandatory for privileged roles. Sessions and devices can be revoked. | In place |
| Immutable bookings and audit log | Bookings, the audit log and hand-overs are append-only; corrections are new entries. The audit log is chained so that changes stand out. | In place |
| Deletion despite immutability | Personal content is encrypted with one key per person. When the retention period ends, the key is destroyed. The deletion job with preview and log is still in progress. | In progress |
| No personal data in logs | Application logs contain identifiers only. Raw badge numbers are never stored, only a hash. | In place |
| Backups and restore | Backups with point-in-time restore and a monthly automated restore test are intended for production operation and still in progress. | In progress |
| Data breaches | We notify customers without undue delay so they can meet their deadlines (Art. 33 GDPR: 72 hours). The workflow in the product is planned. | Planned |
| Independent penetration test | Planned, not yet carried out. | Planned |
Open code
The core is open source (AGPL-3.0). You can read and review the code.
Contracts and texts
You find the DPA, privacy policy and terms of use under Legal. They are drafts for as long as the notice there is shown.
To the legal texts