Technical and Organizational Measures (TOMs) – flowgeist DMS
Status: 27.09.2026
Version: 1.0
Scope: Art. 32 GDPR, Data Processing Agreement (DPA)
These technical and organizational measures describe the security precautions that flowgeist takes to protect personal data on the flowgeist DMS platform.
1. Physical Access Control (Physical Security)
| Measure | Description |
|---|
| Data center | Hetzner Online GmbH, Falkenstein (Germany). Physical security provided by the data center operator (access controls, video surveillance, fire detection system). |
| Deployment model | Single-server Docker deployment (vdps-prod-01). No physical devices at flowgeist. |
2. System Access Control (Logical Security)
| Measure | Description |
|---|
| Password hashing | scrypt with OWASP parameters (N=16384, r=8, p=1, 128-bit salt, 64-byte hash). Format: scrypt:N:r:p:saltB64:hashB64. |
| Authentication | Keycloak 24 (OpenID Connect/OAuth2), JWT validation via JWKS, token refresh |
| Multi-factor authentication | TOTP (RFC 6238, HMAC-SHA1, 30s window) available for users |
| RBAC | Role-based access control with DmsRole enum + RolePermission table (permission catalog: module.resource.action, e.g. crm.customers.read, admin.tenants.manage). Permission matrix: Employee→Admin, Admin→Admin+feature flags, Owner→Owner. |
| Multi-tenant isolation | Strict separation of tenant data at database level via PostgreSQL Row-Level Security (migrations V001__tenants.sql + V005__rls_policies.sql); tenant_id on every table; tenant context via middleware |
| Session management | OIDC code flow via Keycloak; session TTL: 7d access / 30d refresh; rememberMe: 30d |
| Account lockout | Keycloak brute-force detection (for managed accounts) |
| Support access | Admin/Owner access via impersonation flow; specific claim check |
| Production secret management | Infisical — runtime secret injection (no secrets in code); .env.docker.dev for dev only |
3. Data Access Control
| Measure | Description |
|---|
| RLS policies | PostgreSQL Row-Level Security on all tenant tables (V005__rls_policies.sql); session variable app.current_tenant |
| Permission catalog | dms_permission_catalog.csv + dms_role_matrix.csv; permission check in route middleware |
| API access control | Auth middleware on all /v1/ routes; Require-Role/Require-Permission guards |
| Granular permissions | Per-resource actions: read, write, delete, export |
4. Disclosure Control (Data Transmission)
| Measure | Description |
|---|
| TLS | TLS 1.2 and 1.3 for all connections (Nginx frontend, ssl_protocols TLSv1.2 TLSv1.3); Let’s Encrypt/certbot |
| Security headers | HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy |
| API gateway | APISIX 3.9 (optional in prod; direct Nginx routes for Next.js proxy) |
| Webhook security | HMAC-SHA256 signature verification for incoming webhooks; timestamp validation (replay protection) |
| File transfer hub | SFTP for outbound file transfers (P14) |
| Secrets | Infisical; no secrets in code |
| Measure | Description |
|---|
| Audit trail | Logging of security-relevant accesses and actions (A.8.15); append-only audit_log table (V004__audit_log.sql) — triggers prevent UPDATE/DELETE; users cannot delete/modify their own entries |
| AI audit | Every copilot/agent request is logged in the AI register (ai_decision_audit): input hash, tool, model, latency, cost, PII flags, policy denials; 7-year retention (M18 policy) |
| Observability | SigNoz + OpenTelemetry (self-hosted, no data leaves the infrastructure); OTLP traces, logs, metrics |
| Documentation | data-resilience module: GoBD alignment; document versioning via Mayan EDMS |
6. Job Control (Sub-processor Control)
| Measure | Description |
|---|
| Sub-processors | No external sub-processors beyond Hetzner (hosting); all platform components (PostgreSQL, Keycloak, MinIO, OpenSearch, ClickHouse, Kafka, Valkey, Temporal, Novu, Mayan EDMS, ERPNext, Kimai, APISIX, Infisical, SigNoz) are embedded OSS on flowgeist’s own Hetzner infrastructure |
| AI processing | Exclusively EU-resident models (Azure OpenAI EU / self-hosted models such as Mistral/Llama); no transmission to public models; AI register documents deployed systems |
| Customer-configured integrations | Integration Hub connectors (OEM, DAT/Schwacke, DATEV, PEPPOL, banks, charging networks) only become active after customer configuration; no automatic data flow |
| Documentation | Legal documentation (privacy policy, DPA) reflects the current state |
7. Availability Control
| Measure | Description |
|---|
| Backup | Restic for PostgreSQL, MinIO, database dumps (data-resilience module); rclone as transport layer (various remote targets configurable, e.g., S3, SFTP) |
| Recovery | Point-in-time recovery via PostgreSQL WAL; data-resilience module with restore workflows |
| Infrastructure | Hetzner enterprise hardware; single-server deployment with all services as Docker containers |
| Monitoring | SigNoz + OpenTelemetry (self-hosted): traces, logs, metrics, alerts |
8. Separation Requirement (Tenant Separation)
| Measure | Description |
|---|
| Tenant isolation | Strict separation of customer data at database level via PostgreSQL Row-Level Security; tenant_id on every table; app.current_tenant session variable |
| Tenant provisioning | Automated tenant provisioning (V006__tenant_provisioning.sql); no shared schema without RLS |
| Cross-tenant data | Only global, non-tenant tables (permission catalog, feature flags) are not tenant-bound |
| Storage separation | MinIO/S3-compatible object storage with tenant-scoped path schema |
9. Organizational Measures
| Measure | Description |
|---|
| Development process | Code reviews, CI/CD pipeline, module isolation with anti-corruption layer; AGENTS.md as development standard |
| Access management | RBAC model with permission matrix; team assignment via Keycloak groups |
| Documentation | Technical documentation per module (docs/), compliance log per change |
| Confidentiality | All employees are subject to confidentiality obligations |
| Change management | Flyway migrations (versioned, append-only); semantic versioning |
| AI governance | AI register, PII filter, RAG guardrails, human-in-the-loop for approvals (EU AI Act alignment: limited/minimal risk) |
10. Revision
| Version | Date | Changes |
|---|
| 1.0 | 27.09.2026 | Initial version for flowgeist DMS — code-verified: scrypt hashing, Keycloak auth, TOTP, RLS tenant isolation, append-only audit_log, Restic backup, SigNoz, Infisical, APISIX, AI governance, Integration Hub |