Security

How we protect your data

Specifically: where data lives, who can access it and what happens when something goes wrong. No certificates we do not hold.

Data in the EU

Database, sign-in and files in Frankfurt (AWS eu-central-1)

Organisation isolation

Database access rules on every table holding customer data

Encrypted connections

TLS 1.2+ with HSTS; disks encrypted by the infrastructure provider

Access with a reason

Personal data is revealed only with a purpose and reason, and logged

Protection at every layer

What runs today — not plans

Infrastructure

  • Database, sign-in and files in Supabase on AWS in Frankfurt
  • Website and app behind Cloudflare: DDoS and bot protection
  • Website server functions in the EU (Frankfurt)
  • API keys and passwords in a vault, never in code
  • Automated monitoring: more than 70 system health checks with e-mail alerts

Data protection

  • Organisation data isolation enforced by the database (Row Level Security)
  • Personal data masked in admin panels
  • Audio recordings deleted after transcription, within 72 hours at the latest
  • IP addresses from forms stored only as a hash
  • Activity log erased after 180 days; organisation data deleted within 30 days of contract end

Access control

  • Roles: organisation admin, manager, user
  • Sign-in with e-mail or with Google or Microsoft
  • Two-factor authentication (TOTP app) in account settings
  • Our team sees personal data only with a purpose and reason, for 15 minutes, with an alert on unusual volume
  • Log of administrative actions

Application security

  • Schema-based input validation in the website’s public API
  • The website’s public API returns only data from official sources — never customer data
  • Content Security Policy on the website; HSTS on the website and the app
  • Rate limits, honeypots and Cloudflare Turnstile on forms
  • Regular internal security audits, with fixes verified end to end
Incidents

When something goes wrong

Alerts about errors and unusual events reach the team automatically. We handle personal-data breaches in line with the GDPR and report them on time.

  • Security event log kept for 180 days
  • Bot and abuse protection at the network edge
  • Responsible vulnerability disclosure: [email protected]
72 h
Breach notification to the supervisory authority where we are the controller
No delay
Customers informed of a breach affecting their data
Report
Causes and corrective actions after an incident
EU
Storage of app data

Security questions?

We will answer your security questionnaire and explain how we process your organisation’s data. Report vulnerabilities to [email protected].

Write to [email protected]