EPATRONIC
Get in touch

Security & data protection at a glance

This is a convenience translation. Only the German version is legally binding.

Technical and organisational measures pursuant to Art. 32 DSGVO/GDPR for EUTHENIA (Annex 2 to the Data Processing Agreement (AVV)). As of: October 2026 (version 2026-10.1). We only describe what has been implemented; planned measures are marked as such.

Hosting and location

Operated on a server of Hetzner Online GmbH in the Nuremberg data centre (Germany; ISO/IEC 27001 certification of the provider). Physical access control to the data centre is the responsibility of the provider. The database and cache are not reachable from the internet; document storage only via signed links of the application.

Confidentiality

  • Access: Login with password (hashed with bcrypt, minimum length and complexity), two-factor authentication (mandatory after 30 days), limitation of login attempts, sessions with short-lived access tokens and revocable refresh tokens; registration only with a confirmed email address and approval by us.
  • Authorisation: Roles and permissions per module, principle of least privilege; read-only roles cannot change anything.
  • Tenant separation: Every database query is restricted to the tenant; access to records of other tenants is rejected.
  • Files: No public storage; access only via time-limited, signed links after a permission check.
  • Secrets: Two-factor authentication keys are stored encrypted with AES-256-GCM.

Integrity and traceability

  • Log: Logins and important changes are logged with time, user, action and object, without content or passwords. IP addresses and browser identifiers are removed from the log after 90 days.
  • Transmission: exclusively encrypted (TLS) with HSTS; security headers against embedding and data leakage.
  • Changes to the software: Version control and change log (changelog) per version; only the approved, versioned state is rolled out.

Availability and recovery

  • Daily backup of the database, documents and configuration, and before every update; the backups are encrypted on the server (AES-256, key not on the server) and transferred to external storage (STRATO HiDrive).
  • Weekly automatic restore test of the database; automatic notification if a backup fails or is out of date.
  • Retention: 7 daily, 4 weekly and 6 monthly backups.

Data minimisation and deletion

  • Incomplete registrations are deleted after 30 days; passwords are only stored as hash values.
  • Data export for the customer in system administration; deletion after the end of the contract in accordance with AVV § 8.

In preparation

  • Independent penetration test; deletion periods for documents and logs configurable per tenant.

Contact

Questions about data protection and security, and security reports: [email protected].