Technical + organizational measures (Art. 32 GDPR)

Security annex (Anlage TOM) referenced by the DPA and the AVV. Effective alongside the subprocessor register.

The following measures implement the security obligations of Art. 32 GDPR taking into account the state of the art, costs, and the nature, scope, context, and purposes of processing. They describe our current posture; they are reviewed and updated as the service evolves. We do not claim certifications we have not obtained.

1. Confidentiality (Art. 32(1)(b))

Access control: least-privilege production access via an SSH bastion; production credentials are not shared and are rotated on personnel change.
Authentication: user sessions and API access use bearer tokens that are HMAC-SHA256 signed; passwords are stored only as salted hashes, never in plaintext.
Encryption in transit: TLS 1.2+ enforced for all external connections (HTTPS, API, webhooks).
Encryption at rest: AES-256 for data at rest in object storage and the primary database.
Network egress control: outbound HTTP from user-controlled URLs passes an SSRF guard that blocks RFC-1918 ranges, loopback, and cloud-metadata endpoints.
Confidentiality obligations: personnel authorised to process customer data are bound by written confidentiality undertakings.
Tenant isolation: customer data is partitioned per account; access is scoped by the authenticated session/API identity.

2. Integrity (Art. 32(1)(b))

Webhook payloads are HMAC-signed with timestamp-bound signatures and a 5-minute replay window to prevent tampering and replay.
Input validation and request-size limits on API endpoints.
Change management: code changes go through review before deployment; infrastructure changes are tracked.

3. Availability + resilience (Art. 32(1)(b)+(c))

Automated daily backups with 30-day retention; restore procedure tested periodically.
Hosting on EU infrastructure (Hetzner, Germany/Finland) with provider-level redundancy.
Health checks and alerting on core services; error monitoring (consent-gated) to detect incidents.
DDoS mitigation and TLS termination at the edge (Cloudflare).

4. Procedures for regular testing + evaluation (Art. 32(1)(d))

Quarterly internal access review (least-privilege re-attestation).
Independent third-party penetration test annually; the report is available to customers under NDA on request.
Periodic restore tests of the backup procedure.

5. Data-subject rights + incident response

Assistance with data-subject-rights requests (access, rectification, erasure, portability) via documented API endpoints and account export.
Personal-data-breach notification to the customer's registered admin email without undue delay and within 72 hours of becoming aware, including the nature of the breach, affected categories and approximate number of data subjects, likely consequences, and measures taken or proposed.
Audit logs and records of processing available on reasonable request.

6. Deletion + return (Art. 32 + Art. 28(3)(g))

On termination, customer data may be exported within 30 days via documented API endpoints and account export.
Customer personal data is then deleted within 30 days, except where retention is legally required (e.g. billing records for tax purposes).
Object-storage lifecycle sweeps remove transient render artifacts on a defined schedule.