1. Confidentiality: Physical access
- The office in Alfter can be locked; issued keys are recorded in a key register.
- Visitors are only allowed in the office when accompanied by an employee.
- Customer data is not processed in the office but in Microsoft Azure data centres in the Germany West Central region (Frankfurt am Main). Physical access control there is the responsibility of Microsoft.
2. Confidentiality: System and data access
- Central identity management; every sign-in requires multi-factor authentication.
- Passwords are managed in a password manager.
- Role-based permissions following the principle of least privilege; access rights are reviewed every quarter.
- Internal systems can only be reached after identity and device have been verified (zero trust principle).
3. Confidentiality: Devices
- All company devices are managed centrally.
- Hard disks are encrypted.
- Centrally managed malware protection runs on all devices.
- Removable media are only used encrypted.
4. Confidentiality: Classification
- Information is classified as Public, Internal or Confidential.
- Storage, sharing and deletion follow this classification.
5. Integrity: Transfer
- Data is only transmitted with transport encryption (TLS 1.2 or higher).
- Credentials, keys and certificates of the cloud services are kept in a central, access-controlled secret store, not in source code.
6. Integrity: Development
- Every code change is reviewed by a second person in a pull request.
- The build pipeline runs automated checks.
- Every release on Microsoft AppSource goes through Microsoft's validation.
- App packages are delivered signed.
7. Integrity: Logging
- Security-relevant events are logged.
8. Availability and resilience
- The cloud services run on Microsoft Azure.
- The services are monitored continuously; their current state is shown on the public status page.
- The committed availability is defined in the Service Level Agreement.
9. Evaluating effectiveness
- Information security management system (ISMS) according to ISO/IEC 27001 being established; certification is planned.
10. Organisation
- All employees are bound to confidentiality.
- Annual security training for all employees.
- Suppliers and sub-processors are assessed before they are used; the current list is available under Sub-processors.
- Customer data is deleted no later than 90 days after the end of the contract.
Last updated: November 2, 2026