TOMs – DIRIGENT

Version 1.2 · Stand: 08.08.2026

flowgeist ZERO flowgeist KITA flowgeist TOOL flowgeist FOOD CombiJornada DIRIGENT

Technical and Organizational Measures (TOMs) – DIRIGENT

Status: 14.08.2026 Version: 1.0 Scope: Art. 32 GDPR, Art. 28(3)(c) GDPR

1. Access Control to Premises

Measures to prevent unauthorized persons from gaining access to data-processing facilities:

Data center: The servers are operated at Hetzner Online GmbH in Falkenstein (Germany). The data center features multi-tier physical access control.
Data center access control: 24/7 video surveillance, personnel airlock with ID card and biometric control, access logging.
Server rack: Physical locking of server racks. Access only for authorized Hetzner personnel.
Office premises: The office premises of flowgeist are equipped with a mechanical locking system. Access only for authorized persons.
Key management: Strict key management with documentation of key issuance and return.
Visitor control: Visitors are registered and accompanied throughout their entire stay.

2. Access Control to Systems

Measures to prevent unauthorized persons from using data-processing systems and gaining access to personal data:

Authentication: Access to systems and applications requires strong authentication using username and password. Passwords are stored hashed using Argon2id (demo user, if applicable, with bcrypt).
Password policies: Enforcement of password policies (minimum length, complexity, regular changes).
Multi-factor authentication (MFA): Mandatory for all administrative accesses and tenant administrators. Implementation via TOTP (Time-based One-Time Password).
Single Sign-On (SSO): SSO support for centralized authentication in B2B environments.
Role-based access control (RBAC): Strict role-based access control following the least-privilege principle. Users receive only the rights required for their role.
PKCE session: Server-side session management using PKCE (Proof Key for Code Exchange). Sessions are managed on the server side, not in client-side cookies.
Refresh token rotation: A new refresh token is issued on each token renewal to prevent token misuse.
Multi-tenant isolation: Each customer (tenant) receives an isolated data area. Data sharing between tenants is technically excluded through PostgreSQL Row-Level-Security (RLS).
Access logging: All accesses to systems and personal data are logged (ISO 27001 audit trail in accordance with A.12.4).
Session management: Automatic session timeout upon inactivity.
Account lockout: Automatic locking of accounts after multiple failed login attempts.
ThrottlerGuard: Rate limiting to protect against brute-force attacks and abuse.

3. Transmission Control

Measures to ensure that personal data cannot be read, copied, altered, or removed by unauthorized persons during electronic transmission:

Transport encryption: All data transmissions are encrypted using TLS 1.3 (Transport Layer Security). The use of deprecated protocols (SSL, TLS 1.0, TLS 1.1, TLS 1.2) is disabled.
HTTPS: All web communication takes place exclusively via HTTPS (HSTS enabled).
API encryption: All API endpoints require encrypted connections (HTTPS/TLS 1.3).
CORS origin whitelist: In production, strict CORS origin whitelist, no localhost fallback.
Swagger/OpenAPI disabled: Swagger/OpenAPI documentation is disabled in production (ISO 27001 A.13.1.1).
Certificate management: Use of valid TLS certificates with automatic renewal. Monitoring of certificate validity.
Database connections: Connections to the PostgreSQL 18 database are encrypted (SSL/TLS).
Redis connections: Connections to Redis are encrypted.
Backup transmission: Backups are transmitted encrypted.
WAF (Web Application Firewall): Use of a Web Application Firewall to protect against attacks on the transmission layer.

4. Input Control

Measures to enable subsequent verification and determination of whether and by whom personal data has been entered, altered, or removed in data-processing systems:

ISO 27001 audit trail (A.12.4): Logging of all security-relevant actions in accordance with ISO 27001, including:
- Timestamp
- User ID
- Tenant ID
- Action (create, read, update, delete)
- Resource
- IP address
- User-Agent
- Trace IDs (OpenTelemetry W3C Trace Context)
Logging of administrative actions: All administrative actions (user management, role changes, tenant configuration) are logged.
Override audit: Manual overrides in the Workflow Engine (transition checklists, quality gates) are fully logged.
Integrity protection of logs: Audit logs are stored in a tamper-proof manner. Read-only storage with cryptographic protection.
Log retention: Audit logs are retained for 3 years.
Versioning: Data changes are documented with version levels, where applicable.

5. Order Control

Measures to ensure that personal data processed on behalf of the Controller is processed only in accordance with the Controller’s instructions:

Contractual binding: Conclusion of Data Processing Agreements (DPA) in accordance with Art. 28 GDPR with all sub-processors.
Instruction binding: Processing of personal data exclusively in accordance with the documented instructions of the Controller.
Sub-processor control: Careful selection and regular review of sub-processors (Hetzner Online GmbH).
Contractual obligations: All employees and sub-processors are contractually bound to confidentiality.
Documentation: Complete documentation of processing operations and instructions.
No external services: The platform does not use external AI services, no web analytics services, and no payment services. No further external services are used.

6. Availability Control

Measures to protect personal data against accidental destruction or loss:

Backup strategy: Regular automated backups of the PostgreSQL 18 database. Full backups are created daily.
Backup retention: Backups are stored encrypted (AES-256 at rest) and maintained in accordance with the defined retention periods.
Backup testing: Regular verification of backup restoration (restore tests).
Redundancy: Use of redundant system components to avoid single points of failure.
Monitoring: Continuous monitoring of system availability and performance via OpenTelemetry, Loki, Tempo, and Grafana (internal observability). Automatic alerting in case of disruptions.
High availability: The infrastructure at Hetzner Online GmbH provides redundant power supply, cooling, and network connectivity.
Emergency plan: Documented disaster recovery plan with defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
Fault tolerance: Automatic restart in case of system failures. Monitoring of system integrity.
Outbox pattern: State change and event are written in a single transaction to ensure data consistency and availability.

7. Separation Control

Measures to ensure that personal data collected for different processing purposes can be processed separately:

Multi-tenant isolation: Strict logical separation of data between different customers (tenants). Each tenant receives an isolated data area. Data sharing between tenants is technically excluded.
PostgreSQL Row-Level-Security (RLS): Data of different tenants is separated in the PostgreSQL 18 database through Row-Level-Security. In each transaction, SET LOCAL app.tenant_id is executed, and FORCE ROW LEVEL SECURITY ensures that queries are always filtered tenant-specifically.
Tenant context propagation: The tenant context is propagated via JWT claim and applied consistently in each transaction.
Role-based separation: Functional separation through RBAC. Data for different processing purposes (e.g., audit logs, workflow data, notifications) are stored and managed separately.
Environment separation: Strict separation of production, staging, and development environments. Production data is not used in non-production environments.
Log separation: Audit logs are stored separately from operational data to ensure tamper-proof retention.
Module isolation: NestJS modular monolith with strict module isolation. Communication between modules takes place exclusively via internal API routes.

8. Encryption

Measures to ensure the confidentiality and integrity of personal data through encryption:

Transport encryption: TLS 1.3 for all data transmissions (HTTPS, API, database connections, Redis, backup transmission).
Encryption at rest: AES-256 encryption for stored data (database, backups, file systems).
Password hashing: Passwords are stored using Argon2id, a modern and secure hashing method. No plaintext passwords are stored. Demo user, if applicable, with bcrypt.
MFA secrets: TOTP secrets for multi-factor authentication are stored encrypted.
Key management: Secure management of encryption keys. Keys are stored separately from the encrypted data.

9. Pseudonymization

Measures for the pseudonymization of personal data:

Pseudonymization of audit data: IP addresses in audit logs are pseudonymized or deleted after the retention period expires.
Tenant IDs: The attribution of data to a specific customer is made via pseudonymous tenant IDs, which do not allow direct inference of the customer’s identity without access to the mapping table.
Trace IDs: OpenTelemetry trace IDs enable pseudonymous correlation of requests across system boundaries, without revealing personal data.

10. Regular Review

Measures for the regular review and assessment of the effectiveness of the technical and organizational measures:

Review of TOMs: Regular review and updating of the technical and organizational measures, at least annually.
ISO 27001: The platform is operated in accordance with ISO 27001. Regular review of security configurations and access rights within the framework of the ISMS.
Security audits: Regular review of security configurations and access rights.
Penetration tests: Regular performance of penetration tests and security assessments of the platform.
Vulnerability management: Continuous monitoring and remediation of known vulnerabilities (vulnerability management). Regular updates and patch management.
Incident response plan: Documented process for responding to security incidents. Definition of responsibilities and escalation paths.
Employee awareness: Regular training and sensitization of employees regarding data protection and information security.
Monitoring: Continuous monitoring of systems and networks via OpenTelemetry/Loki/Tempo/Grafana to detect anomalies and potential security incidents.
Log analysis: Regular analysis of audit logs and access logs to detect misuse.

11. Sub-processors

The following sub-processors are engaged in the processing of personal data for DIRIGENT:

Sub-processor	Location	Purpose	Third-country reference	DPA	TOMs
Hetzner Online GmbH	Germany (Falkenstein)	Hosting, database (PostgreSQL 18), Redis, backup, observability (OpenTelemetry/Loki/Tempo/Grafana)	No third countries	Yes (Art. 28(4) GDPR)	Yes

Hetzner Online GmbH: As a hosting provider, Hetzner Online GmbH processes personal data in Germany (Falkenstein). No transfer to third countries takes place. The internal observability stack (OpenTelemetry, Loki, Tempo, Grafana) runs on the same Hetzner server, so no third-country transfer occurs. A Data Processing Agreement in accordance with Art. 28(4) GDPR has been concluded with Hetzner. Hetzner has its own TOMs in accordance with Art. 32 GDPR, which ensure the level of protection for processing in Germany.

No further external services: The DIRIGENT platform does not use external AI services, no web analytics services, no payment services, and no further external services. The planned integrations (Booking-Service and Notification via MS365 Graph API) will be carried out exclusively on the basis of separate Data Processing Agreements. The list of sub-processors is complete.

12. Change History

Version	Date	Material Changes
1.0	14.08.2026	Initial version of the TOMs for DIRIGENT