Where your data lives and who sees it

Our hosting provider Google Cloud belongs to a US group. In exceptional cases, US authorities could demand access to data held by Google, including in Switzerland. We have assessed and accepted this residual risk.

Documents are read in Paris (Scaleway fr-par). If an error occurs, Scaleway may keep a request for up to two weeks to analyse it.

Transactional mail is configured for Scaleway in Paris, but delivery is not claimed until the production mail gate is on.

Customers are told before a sub-processor is added. The signed DPA that carries this notice is not in this process.

Digital Thinktank GmbH is the processor. The customer is the controller. The contract form is a DPA under Art. 9 revFADP. The signed DPA is not in this process.

A personal-data breach is notified to the customer without undue delay.

Requests to access, correct or delete personal data are routed to the customer, who is the controller.

Books and vouchers are kept for 10 years after the fiscal year (OR 958f, GeBüV). A storage lifecycle that enforces that date is not applied in this process.

A lawful order may require access without consent. The customer is notified unless the order prohibits it. The access is logged once notification is allowed.

There is no standing staff access to tenant data.

Support access is one tenant, a purpose and a ticket id, granted by an owner. The default is 24 hours and the maximum is 72. It can be revoked and it expires on its own. Granting it needs a fresh sign-in. In this application, a different administrator must approve each access. Write mode is off. Support cannot export or download the books.

Each company's rows are isolated in Postgres. The tenant id comes from the session.

The server can read documents. OCR, the assistant and the year-end pack need the plaintext.

Clients that use HTTPS get TLS. That is encryption in transit.

Sign-in can add a passkey or a time-based code. Sessions are listed and can be revoked.

Vulnerability reports use the contact in /.well-known/security.txt. Inbound mail is at Infomaniak. This application does not read that mailbox.

You can export all your data as a ZIP (documents, journal, year-end files, logs), readable without Umbu, up to twice a day. Each download needs a fresh sign-in until the file expires after 24 hours.