Status: 29.08.2026
Version: 1.2
Scope: Art. 32 GDPR, Art. 28(3)(c) GDPR
1. Access Control to Premises
Measures to prevent unauthorized persons from gaining access to data-processing facilities:
- Data center: The servers are operated at Hetzner Online GmbH in Falkenstein (Germany). The data center features multi-tier physical access control.
- Data center access control: 24/7 video surveillance, personnel airlock with ID card and biometric control, access logging.
- Server rack: Physical locking of server racks. Access only for authorized Hetzner personnel.
- Office premises: The office premises of flowgeist are equipped with a mechanical locking system. Access only for authorized persons.
- Key management: Strict key management with documentation of key issuance and return.
- Visitor control: Visitors are registered and accompanied throughout their entire stay.
2. Access Control to Systems
Measures to prevent unauthorized persons from using data-processing systems and gaining access to personal data:
- Authentication: Access to systems and applications requires strong authentication using username and password.
- Password policies: Enforcement of password policies (minimum length, complexity, regular changes). Passwords are stored hashed using Argon2id.
- Multi-factor authentication (MFA): Mandatory for all administrative accesses and tenant administrators. Implementation via TOTP (Time-based One-Time Password).
- Role-based access control (RBAC): Strict role-based access control. Users receive only the rights required for their role (least-privilege principle).
- Multi-tenant isolation: Each customer (tenant) receives an isolated data area. All queries are filtered per tenant; the tenant assignment is resolved server-side from the authentication context and enforced by a guard pipeline on every request.
- Access logging: All accesses to systems and personal data are logged (audit trail).
- Session management: Automatic session timeout upon inactivity. Refresh token rotation to prevent token misuse.
- Account lockout: Automatic locking of accounts after multiple failed login attempts.
3. Transmission Control
Measures to ensure that personal data cannot be read, copied, altered, or removed by unauthorized persons during electronic transmission:
- Transport encryption: All data transmissions are encrypted using TLS 1.2 or TLS 1.3 (Transport Layer Security). The use of deprecated protocols (SSL, TLS 1.0, TLS 1.1) is disabled.
- HTTPS: All web communication takes place exclusively via HTTPS (HSTS enabled).
- API encryption: All API endpoints require encrypted connections (HTTPS/TLS 1.2/1.3).
- Certificate management: Use of valid TLS certificates with automatic renewal. Monitoring of certificate validity.
- Database connections: Connections to the PostgreSQL 16 database are encrypted (SSL/TLS).
- Backup transmission: Backups are transmitted encrypted.
- WAF (Web Application Firewall): A dedicated Web Application Firewall is currently not implemented; deployment is planned. Protection is currently provided by rate limiting and security headers at reverse-proxy level.
Measures to enable subsequent verification and determination of whether and by whom personal data has been entered, altered, or removed in data-processing systems:
- Audit trail: Logging of all security-relevant actions, including:
- Login and logout timestamps
- Actions performed (create, read, update, delete)
- User ID of the acting user
- IP address of the accessing system
- Timestamps
- Logging of tool usage data: Recording of who borrowed and returned which tool, with timestamp and user ID.
- Logging of administrative actions: All administrative actions (user management, role changes, tenant configuration) are logged.
- Integrity protection of logs: Audit logs are stored separately from operational data and protected against subsequent modification (append-only by convention, no update paths in the application). Additional cryptographic chaining (hash chain) is planned.
- Log retention: Audit logs are automatically deleted after the configured retention period (currently 12 months). Security events (login/logout, IP address) are retained in a separate security log for 2 years.
- Versioning: Data changes are documented with version levels, where applicable.
5. Order Control
Measures to ensure that personal data processed on behalf of the Controller is processed only in accordance with the Controller’s instructions:
- Contractual binding: Conclusion of Data Processing Agreements (DPA) in accordance with Art. 28 GDPR with all sub-processors.
- Instruction binding: Processing of personal data exclusively in accordance with the documented instructions of the Controller.
- Sub-processor control: Careful selection and regular review of sub-processors (Hetzner Online GmbH, Mistral AI SAS, Serper.dev).
- Contractual obligations: All employees and sub-processors are contractually bound to confidentiality.
- Documentation: Complete documentation of processing operations and instructions.
6. Availability Control
Measures to protect personal data against accidental destruction or loss:
- Backup strategy: Regular automated backups of the PostgreSQL 16 database. Full backups are created daily.
- Backup retention: Backups are stored encrypted and maintained in accordance with the defined retention periods.
- Backup testing: Regular verification of backup restoration (restore tests).
- Redundancy: Use of redundant system components to avoid single points of failure.
- Monitoring: Continuous monitoring of system availability and performance. Automatic alerting in case of disruptions.
- High availability: The infrastructure at Hetzner Online GmbH provides redundant power supply, cooling, and network connectivity.
- Emergency plan: Documented disaster recovery plan with defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
- Fault tolerance: Automatic restart in case of system failures. Monitoring of system integrity.
7. Separation Control
Measures to ensure that personal data collected for different processing purposes can be processed separately:
- Multi-tenant isolation: Strict logical separation of data between different customers (tenants). Each tenant receives an isolated data area at application level.
- Database separation: Data of different tenants is separated in the PostgreSQL 16 database by strict tenant IDs. Access controls ensure that queries are always filtered tenant-specifically.
- Role-based separation: Functional separation through RBAC. Data for different processing purposes (e.g., audit logs, usage data, billing data) are stored and managed separately.
- Environment separation: Strict separation of production, staging, and development environments. Production data is not used in non-production environments.
- Log separation: Audit logs are stored separately from operational data to ensure tamper-proof retention.
8. Encryption
Measures to ensure the confidentiality and integrity of personal data through encryption:
- Transport encryption: TLS 1.2 and 1.3 for all data transmissions (HTTPS, API, database connections, backup transmission).
- Encryption at rest: AES-256 encryption for stored data (database, backups, file systems).
- Password hashing: Passwords are stored using Argon2id, a modern and secure hashing method. No plaintext passwords are stored.
- MFA secrets: TOTP secrets for multi-factor authentication are stored server-side in the database; field-level encryption is planned. Recovery codes are stored as Argon2 hashes.
- Key management: Secure management of encryption keys. Keys are stored separately from the encrypted data.
- No payment data: flowgeist TOOL currently does not process payment data and does not store credit card data.
9. Pseudonymization
Measures for the pseudonymization of personal data:
- Pseudonymous identifiers: Internal references (tenant IDs, user IDs) are stored as UUIDs and contain no personal attributes.
- Deletion of audit data: IP addresses in security logs are automatically deleted after the retention period expires.
- Tenant IDs: The attribution of data to a specific customer is made via pseudonymous tenant IDs, which do not allow direct inference of the customer’s identity without access to the mapping table.
10. Regular Review
Measures for the regular review and assessment of the effectiveness of the technical and organizational measures:
- Review of TOMs: Regular review and updating of the technical and organizational measures, at least annually.
- Security audits: Regular review of security configurations and access rights.
- Penetration tests: Regular performance of penetration tests and security assessments of the platform.
- Vulnerability management: Continuous monitoring and remediation of known vulnerabilities (vulnerability management). Regular updates and patch management.
- Incident response plan: Documented process for responding to security incidents. Definition of responsibilities and escalation paths.
- Employee awareness: Regular training and sensitization of employees regarding data protection and information security.
- Monitoring: Continuous monitoring of systems and networks to detect anomalies and potential security incidents.
- Log analysis: Regular analysis of audit logs and access logs to detect misuse.
11. Sub-processors
The following sub-processors are engaged in the processing of personal data for flowgeist TOOL:
| Sub-processor | Location | Purpose | Third-country reference | DPA | TOMs |
|---|
| Hetzner Online GmbH | Germany (Falkenstein) | Hosting, database (PostgreSQL 16), backup | No third countries | Yes (Art. 28(4) GDPR) | Yes |
| Mistral AI SAS | France (FR) | AI text generation and image analysis (Mistral Vision API) | None (EU-only) | Yes (Art. 28(4) GDPR) | Yes |
| Serper.dev | USA (US) | Web search for AI-supported functions | EU-US Data Privacy Framework + SCC | Yes (Art. 28(4) GDPR) | Yes |
Hetzner Online GmbH: As a hosting provider, Hetzner Online GmbH processes personal data in Germany (Falkenstein). No transfer to third countries takes place. A Data Processing Agreement in accordance with Art. 28(4) GDPR has been concluded with Hetzner. Hetzner has its own TOMs in accordance with Art. 32 GDPR, which ensure the level of protection for processing in Germany.
Mistral AI SAS: The platform uses the Mistral Vision API for AI-supported image analysis and text generation. Mistral AI is headquartered in France (EU Member State), no third-country transfer. GDPR is directly applicable. A DPA in accordance with Art. 28(4) GDPR has been concluded with Mistral AI. Transmitted data (image and text requests) is deleted after processing.
Serper.dev: The platform uses the Serper.dev API for web search in the context of AI-supported functions. Serper.dev is headquartered in the USA (third country). Data transfer is carried out on the basis of the EU-US Data Privacy Framework and supplementary Standard Contractual Clauses (SCC). A DPA in accordance with Art. 28(4) GDPR has been concluded with Serper.dev. Only search queries (no master data) are transmitted.
12. Change History
| Version | Date | Material Changes |
|---|
| 1.0 | 08.08.2026 | Initial version of the TOMs for flowgeist TOOL |
| 1.1 | 29.08.2026 | Correction of sub-processor list: addition of Mistral AI SAS and Serper.dev as sub-processors; removal of “no external AI services” statement (contradicted code implementation) |
| 1.2 | 22.09.2026 | Code review (claims matrix): Stripe removed as sub-processor (payment processing currently not implemented); TLS statement unified to 1.2/1.3; WAF marked as planned; audit retention corrected to implemented periods (12 months audit / 2 years security log); TOTP secret encryption marked as planned; multi-tenant claim clarified to application-level filtering; IP pseudonymization replaced by deletion |