TOMs – CombiJornada

Version 1.2 · Stand: 08.08.2026

flowgeist ZERO flowgeist KITA flowgeist TOOL flowgeist FOOD CombiJornada

Technical and Organizational Measures (TOMs) – CombiJornada

As of: 08.08.2026 Version: 1.0 Scope: Art. 32 GDPR, Art. 28(3)(c) GDPR

1. Access Control

Measures to ensure that only authorized persons obtain physical access to data processing facilities:

Data center: Hosting with Hetzner Online GmbH (Falkenstein, Germany). The data center is ISO 27001-certified.
Physical access control: Access to the data center exclusively for authorized personnel via multi-stage authentication (chip card + PIN/biometrics).
Video surveillance: 24/7 video surveillance of the data center areas, retention of recordings in accordance with legal requirements.
Visitor logging: All visitors are registered (name, company, time, escort).
Fire and intrusion protection: Smoke detectors, gas extinguishing system, intrusion alarm system with alarm forwarding to security service.
Power supply: Redundant power supply (UPS + diesel emergency generator) for at least 24 hours of autonomy.
Climate control: Redundant climate control with monitoring of temperature and humidity.

Since flowgeist as a SaaS provider operates the infrastructure at Hetzner, physical access control is primarily the responsibility of the data center operator. flowgeist restricts physical access to its own systems to authorized employees.

2. Access Control

Measures to ensure that only authorized persons obtain access to data processing systems and can process data:

Authentication: NextAuth + JWT (JSON Web Tokens) for the application layer. Passwords are stored as hash (bcrypt/argon2), never in plaintext.
Multi-Factor Authentication (MFA): MFA is optionally available and recommended for administrators.
Role-Based Access Control (RBAC): Role-based access control with defined roles (Administrator, HR personnel, Employee self-service). Each role has only the permissions necessary for its tasks (Least Privilege principle).
System-level access: SSH access to servers exclusively via SSH keys (no password login). Access only for authorized administrators.
Database access: PostgreSQL access via authenticated connections with separate database users and role-based permissions.
Redis access: Redis access via authenticated connections with password protection and namespace separation.
Access logging: All accesses to systems and data are logged (login time, user, action, IP address).
Session management: JWT-based sessions with defined validity period and automatic timeout on inactivity.
Password policy: Minimum length 12 characters, complexity requirements (upper/lower case letters, numbers, special characters), lockout after repeated failed attempts.

3. Transfer Control

Measures to ensure that personal data cannot be unauthorized read, copied, altered, or removed during electronic transmission:

Transport encryption: TLS 1.3 for all data transmissions (HTTPS for web traffic, TLS for database connections, TLS for Redis connections).
HSTS (HTTP Strict Transport Security): Enabled to ensure that connections are made exclusively via HTTPS. HSTS with includeSubDomains and preload.
Certificates: Let’s Encrypt TLS certificates with automatic renewal (90-day certificates).
Forward Secrecy: TLS configuration with Perfect Forward Secrecy (ECDHE), so that recorded connections cannot be subsequently decrypted.
Internal communication: Encrypted connections between all internal components (web server, database, Redis, AWS S3).
API security: All API endpoints require authentication (JWT) and are accessible exclusively via HTTPS.
S3 transfer: Data transfer to AWS S3 takes place exclusively via HTTPS (TLS).

4. Input Control

Measures to ensure that it can be subsequently verified whether and by whom personal data has been entered into, altered, or removed from data processing systems:

Audit Trail: Logging of all security-relevant actions in the CombiJornada platform:
- Login/logout events (time, user, IP address)
- Creation, modification, and deletion of working time data
- Changes to shift and roster plans
- Approval/rejection actions on vacation requests
- Changes to user roles and permissions
- Export and report actions
WORM Logs (Write Once, Read Many): Audit logs are stored in a WORM format that prevents subsequent modification or deletion of individual entries.
Immutability: Audit logs are protected against manipulation by cryptographic methods (hash chaining).
Logging of administrative actions: All administrative actions (user management, configuration changes) are logged.
Retention of audit logs: 3-year retention period for audit logs.

5. Order Control

Measures to ensure that personal data processed on behalf of the Controller is processed only in accordance with the Controller’s instructions:

Instruction binding: All employees of flowgeist who are entrusted with the processing of personal data are subject to instruction binding in accordance with Art. 28(3)(a) GDPR.
Contractual arrangements: DPA with all Sub-processors (Hetzner, Stripe, AWS S3) in accordance with Art. 28(4) GDPR.
Technical separation: Data from different clients (tenants) is technically separated (multi-tenant isolation, see Separation Control).
Record of processing activities: Maintenance of a record of processing activities in accordance with Art. 30 GDPR.
Training: Regular training of employees on data protection and information security.
Sub-processor control: Regular review of Sub-processors for compliance with the DPA requirements.

6. Availability Control

Measures to ensure that personal data is protected against accidental destruction or loss:

Daily backups: Daily automatic backups of the PostgreSQL database. Backups are stored encrypted (AES-256).
Backup retention: Backups are retained according to a defined retention policy (daily: 7 days, weekly: 4 weeks, monthly: 12 months).
Redis cache: Redis is used as a cache. Redis data is reproducible from the PostgreSQL database and therefore not critical for data integrity.
Backup verification: Regular verification of backup integrity (restore tests on a quarterly basis).
Redundancy: Redundant system architecture with automatic failover in case of individual component failure.
Monitoring: 24/7 monitoring of system availability with automatic alerting in case of disruptions.
Disaster recovery: Documented disaster recovery procedure with defined Recovery Point Objective (RPO ≤ 24h) and Recovery Time Objective (RTO ≤ 4h).
AWS S3 availability: AWS S3 offers built-in redundancy (99.999999999% / 11x9 data durability) and versioning.
Power and network redundancy: Redundant power supply and network connections in the data center.

7. Separation Control

Measures to ensure that data collected for different purposes is processed separately:

Multi-tenant architecture: The CombiJornada platform implements strict multi-tenant isolation. Data from different clients (tenants) is logically and technically separated.
Database isolation: PostgreSQL Row-Level Security and Tenant-ID-based filtering ensure that one tenant cannot view data from another tenant.
Redis namespace isolation: Redis caches use namespace separation (namespace prefixing per tenant) to exclude any mixing of cache data between tenants.
AWS S3 separation: File storage in AWS S3 is done with tenant-specific bucket prefixes and bucket policies that restrict access to the respective tenant.
Role-based data access: Within a tenant, data access is controlled via RBAC (e.g., employees see only their own working time data, HR personnel see all).
Separation of production and development environments: Strict separation of production, staging, and development environments. No personal data in development or test environments.
Log separation: Audit logs are stored separately from application data and are accessible only to authorized administrators.

8. Encryption

Measures to protect personal data through encryption:

Database encryption (at-rest): PostgreSQL database with AES-256 encryption at volume level (LUKS / Hetzner Volume Encryption).
Transport encryption (in-transit): TLS 1.3 for all data transmissions (see Transfer Control).
AWS S3 server-side encryption: All objects stored in AWS S3 are encrypted server-side (SSE-S3, AES-256).
Password hashing: Passwords are hashed with bcrypt/argon2 (with salt and sufficient cost factor). No plaintext storage.
JWT signing: JSON Web Tokens are cryptographically signed (HMAC-SHA256 or RS256) to prevent manipulation.
Backup encryption: All backups are encrypted with AES-256.
Redis encryption: Redis connections are encrypted via TLS.
Key management: Cryptographic keys are securely managed (separate storage, access restrictions, regular rotation).

9. Pseudonymization

Measures for the pseudonymization of personal data:

Tenant-IDs: Data is assigned pseudonymously via Tenant-IDs, so that direct assignment to a client is only possible with additional information.
User-IDs: Internal user identifiers (UUIDs) are used instead of plaintext names in logs and caches, wherever technically possible.
Audit logs: In audit logs, pseudonymized identifiers are used wherever possible. The mapping table is stored separately and access-protected.
Reporting: In aggregated reports, data is presented pseudonymously where this is sufficient for the purpose.
Limitation: Due to the nature of the platform (working time and shift planning), complete pseudonymization is not possible, as the assignment of working times to specific employees is functionally required (Art. 34 Estatuto de los Trabajadores).

10. Regular Review

Measures for the regular review and assessment of the effectiveness of the TOMs:

Review interval: The TOMs are reviewed at least annually and adjusted as needed.
Security audits: Regular security audits of the platform (at least annually), including penetration testing by external service providers.
Incident management: Documented procedure for handling security incidents (Incident Response Plan) with defined escalation levels and reporting obligations.
Vulnerability management: Continuous monitoring of security vulnerabilities (CVE databases) and timely installation of security updates.
Patch management: Automated and manual patch processes for operating system, runtime environment (Next.js 15, React 19, Node.js), and dependencies.
Dependency checking: Regular review of npm dependencies for known vulnerabilities (npm audit / Dependabot).
Employee training: Annual training of all employees on data protection (GDPR, LOPDGDD) and information security.
Certification: Pursuing ISO 27001 certification; Hetzner data center already ISO 27001-certified.
Documentation: All reviews and audits are documented and made available to the supervisory authority upon request.

11. Sub-processors

The following Sub-processors are engaged within the CombiJornada platform:

Sub-processor	Headquarters	Service	Third country transfer	Protective measures
Hetzner Online GmbH	Germany (Falkenstein)	Hosting, PostgreSQL 16, Redis, backup	None (EU)	ISO 27001-certified data center, DPA
Stripe Payments Europe, Ltd.	Ireland (IE) / USA (US parent company)	Payment processing	EU-US DPF + SCC	DPA, EU-US Data Privacy Framework, SCC
AWS S3 (Amazon Web Services, Inc.)	USA / EU	File storage (documents, PDFs)	EU-US DPF + SCC	DPA, EU-US Data Privacy Framework, SCC, SSE-S3

DPA agreements in accordance with Art. 28(4) GDPR have been concluded with all Sub-processors. The Sub-processors are regularly reviewed for compliance with the data protection requirements.

12. AWS S3 Specifics

The use of AWS S3 for file storage requires special protective measures due to the Third country transfer (USA):

Server-side encryption (SSE-S3, AES-256): All objects stored in AWS S3 are encrypted server-side (SSE-S3 with AES-256). Encryption is enabled by default for all buckets and cannot be disabled.
Bucket policies with Least Privilege: Access to S3 buckets follows the Least Privilege principle. Bucket policies and IAM policies are configured so that only authorized services and users can access the respective buckets. Public access (Block Public Access) is blocked for all buckets.
Region configuration: The AWS region eu-central-1 (Frankfurt, Germany) is preferred for data storage to ensure data processing within the EU. US regions are used only when specifically needed (e.g., for specific services). In such cases, the transfer takes place on the basis of the EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCC).
Access logging enabled: S3 access logging is enabled for all buckets. All accesses (read, write, delete) to S3 objects are logged. The access logs are stored in separate, access-protected logging buckets.
Versioning: S3 bucket versioning is enabled to prevent accidental deletion or overwriting of objects. Deleted objects can be restored.
Lifecycle policies: Defined lifecycle policies control the automatic deletion or archiving of objects after expiry of the retention periods.
Transfer Impact Assessment (TIA): A TIA in accordance with Art. 46 GDPR has been conducted for the use of AWS S3 in US regions. The TIA is updated at least annually and reviewed upon changes in the legal situation (in particular the EU-US Data Privacy Framework).
Data minimization: Only the files necessary for the respective purpose are stored in AWS S3. Personal data in documents (e.g., employment contracts) is automatically deleted after expiry of the retention periods.

13. Change History

Version	Date	Material changes
1.0	08.08.2026	Initial version of the TOMs for CombiJornada