How do we protect your data?
Instead of big promises we write down what we do. If something is not listed here, we do not promise it.
An environment of your own
Every customer runs in an isolated environment with its own database, file storage and resource limits. Data in one environment is never shared with another.
Account security
Two-step verification and passkeys are supported. Passwords are never stored as plain text. Repeated failed sign-ins are slowed down by rate limits.
Permissions and roles
Role-based permissions let you decide who can see and change what. Sensitive modules such as payment receipts support user- and time-based access rules.
Everything is on record
Assignments, entries, approvals and setting changes are logged with who and when. The audit log of payment receipts cannot be altered.
Transport, storage and backups
Connections are encrypted with HTTPS. Secrets such as passwords and API keys are stored encrypted. Backups are encrypted and can be scheduled.
Payment security
You enter your card details on the payment provider’s encrypted page; they never reach us and are never stored by us. The result of the payment is verified through a signed notification.
Privacy and data protection
You own the data you enter; we process it only to provide the service. Privacy-notice and consent flows for your employees are built into the product. The details are in the Privacy Policy.
AI access under your control
MCP access works only when you switch it on; it connects with OAuth 2.1 or an API key and deletions always ask for confirmation.
Shared responsibility
Keeping your passwords safe and granting permissions sensibly is up to you. If you notice anything suspicious or a vulnerability, write to us right away.
To report a security issue: [email protected]
We are here for your security questions.
If you are running a formal assessment, send us your questions and we will answer in writing.