Status: 08.08.2026
Version: 1.0
Scope: Art. 32 GDPR, Art. 28(3)(c) GDPR
1. Access Control to Premises
Measures to prevent unauthorized persons from gaining access to data-processing facilities:
- Data center: The servers are operated at Hetzner Online GmbH in Falkenstein (Germany). The data center features multi-tier physical access control.
- Data center access control: 24/7 video surveillance, personnel airlock with ID card and biometric control, access logging.
- Server rack: Physical locking of server racks. Access only for authorized Hetzner personnel.
- Office premises: The office premises of flowgeist are equipped with a mechanical locking system. Access only for authorized persons.
- Key management: Strict key management with documentation of key issuance and return.
- Visitor control: Visitors are registered and accompanied throughout their entire stay.
2. Access Control to Systems
Measures to prevent unauthorized persons from using data-processing systems and gaining access to personal data:
- Authentication: Access to systems and applications requires strong authentication using username and password.
- Password policies: Enforcement of password policies (minimum length, complexity, regular changes). Passwords are stored hashed using Argon2id.
- Multi-factor authentication (MFA): Mandatory for all administrative accesses and tenant administrators. Implementation via TOTP (Time-based One-Time Password).
- Role-based access control (RBAC): Strict role-based access control. Users receive only the rights required for their role (least-privilege principle).
- Multi-tenant isolation: Each customer (tenant) receives an isolated data area. Data sharing between tenants is technically excluded.
- Access logging: All accesses to systems and personal data are logged (audit trail).
- Session management: Automatic session timeout upon inactivity. Refresh token rotation to prevent token misuse.
- Account lockout: Automatic locking of accounts after multiple failed login attempts.
3. Transmission Control
Measures to ensure that personal data cannot be read, copied, altered, or removed by unauthorized persons during electronic transmission:
- Transport encryption: All data transmissions are encrypted using TLS 1.3 (Transport Layer Security). The use of deprecated protocols (SSL, TLS 1.0, TLS 1.1, TLS 1.2) is disabled.
- HTTPS: All web communication takes place exclusively via HTTPS (HSTS enabled).
- API encryption: All API endpoints require encrypted connections (HTTPS/TLS 1.3).
- Certificate management: Use of valid TLS certificates with automatic renewal. Monitoring of certificate validity.
- Database connections: Connections to the PostgreSQL 16 database are encrypted (SSL/TLS).
- Backup transmission: Backups are transmitted encrypted.
- WAF (Web Application Firewall): Use of a Web Application Firewall to protect against attacks on the transmission layer.
Measures to enable subsequent verification and determination of whether and by whom personal data has been entered, altered, or removed in data-processing systems:
- Audit trail: Logging of all security-relevant actions, including:
- Login and logout timestamps
- Actions performed (create, read, update, delete)
- User ID of the acting user
- IP address of the accessing system
- Timestamps
- Logging of tool usage data: Recording of who borrowed and returned which tool, with timestamp and user ID.
- Logging of administrative actions: All administrative actions (user management, role changes, tenant configuration) are logged.
- Integrity protection of logs: Audit logs are stored in a tamper-proof manner. Read-only storage with cryptographic protection.
- Log retention: Audit logs are retained for 3 years.
- Versioning: Data changes are documented with version levels, where applicable.
5. Order Control
Measures to ensure that personal data processed on behalf of the Controller is processed only in accordance with the Controller’s instructions:
- Contractual binding: Conclusion of Data Processing Agreements (DPA) in accordance with Art. 28 GDPR with all sub-processors.
- Instruction binding: Processing of personal data exclusively in accordance with the documented instructions of the Controller.
- Sub-processor control: Careful selection and regular review of sub-processors (Hetzner Online GmbH, Stripe Payments Europe, Ltd.).
- Contractual obligations: All employees and sub-processors are contractually bound to confidentiality.
- Documentation: Complete documentation of processing operations and instructions.
- No external services: The platform does not use external AI services and no external analytics services. No further external services are used.
6. Availability Control
Measures to protect personal data against accidental destruction or loss:
- Backup strategy: Regular automated backups of the PostgreSQL 16 database. Full backups are created daily.
- Backup retention: Backups are stored encrypted and maintained in accordance with the defined retention periods.
- Backup testing: Regular verification of backup restoration (restore tests).
- Redundancy: Use of redundant system components to avoid single points of failure.
- Monitoring: Continuous monitoring of system availability and performance. Automatic alerting in case of disruptions.
- High availability: The infrastructure at Hetzner Online GmbH provides redundant power supply, cooling, and network connectivity.
- Emergency plan: Documented disaster recovery plan with defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
- Fault tolerance: Automatic restart in case of system failures. Monitoring of system integrity.
7. Separation Control
Measures to ensure that personal data collected for different processing purposes can be processed separately:
- Multi-tenant isolation: Strict logical separation of data between different customers (tenants). Each tenant receives an isolated data area. Data sharing between tenants is technically excluded.
- Database separation: Data of different tenants is separated in the PostgreSQL 16 database by strict tenant IDs. Access controls ensure that queries are always filtered tenant-specifically.
- Role-based separation: Functional separation through RBAC. Data for different processing purposes (e.g., audit logs, usage data, billing data) are stored and managed separately.
- Environment separation: Strict separation of production, staging, and development environments. Production data is not used in non-production environments.
- Log separation: Audit logs are stored separately from operational data to ensure tamper-proof retention.
8. Encryption
Measures to ensure the confidentiality and integrity of personal data through encryption:
- Transport encryption: TLS 1.3 for all data transmissions (HTTPS, API, database connections, backup transmission).
- Encryption at rest: AES-256 encryption for stored data (database, backups, file systems).
- Password hashing: Passwords are stored using Argon2id, a modern and secure hashing method. No plaintext passwords are stored.
- MFA secrets: TOTP secrets for multi-factor authentication are stored encrypted.
- Key management: Secure management of encryption keys. Keys are stored separately from the encrypted data.
- No credit card data: flowgeist does not store complete credit card data. Payment processing is handled via Stripe, which processes and tokenizes the card data directly.
9. Pseudonymization
Measures for the pseudonymization of personal data:
- Stripe webhook logs: Personal data in Stripe webhook logs is pseudonymized after 30 days, so that attribution to a person is no longer possible without additional information.
- Tokenization: Payment data is tokenized by Stripe. flowgeist stores only the Stripe Customer ID, not the complete payment data.
- Pseudonymization of audit data: IP addresses in audit logs are pseudonymized or deleted after the retention period expires.
- Tenant IDs: The attribution of data to a specific customer is made via pseudonymous tenant IDs, which do not allow direct inference of the customer’s identity without access to the mapping table.
10. Regular Review
Measures for the regular review and assessment of the effectiveness of the technical and organizational measures:
- Review of TOMs: Regular review and updating of the technical and organizational measures, at least annually.
- Security audits: Regular review of security configurations and access rights.
- Penetration tests: Regular performance of penetration tests and security assessments of the platform.
- Vulnerability management: Continuous monitoring and remediation of known vulnerabilities (vulnerability management). Regular updates and patch management.
- Incident response plan: Documented process for responding to security incidents. Definition of responsibilities and escalation paths.
- Employee awareness: Regular training and sensitization of employees regarding data protection and information security.
- Monitoring: Continuous monitoring of systems and networks to detect anomalies and potential security incidents.
- Log analysis: Regular analysis of audit logs and access logs to detect misuse.
11. Sub-processors
The following sub-processors are engaged in the processing of personal data for flowgeist TOOL:
| Sub-processor | Location | Purpose | Third-country reference | DPA | TOMs |
|---|
| Hetzner Online GmbH | Germany (Falkenstein) | Hosting, database (PostgreSQL 16), backup | No third countries | Yes (Art. 28(4) GDPR) | Yes |
| Stripe Payments Europe, Ltd. | Ireland / USA (parent company) | Payment processing | EU-US Data Privacy Framework + SCC | Yes (Art. 28(4) GDPR) | Yes |
Hetzner Online GmbH: As a hosting provider, Hetzner Online GmbH processes personal data in Germany (Falkenstein). No transfer to third countries takes place. A Data Processing Agreement in accordance with Art. 28(4) GDPR has been concluded with Hetzner. Hetzner has its own TOMs in accordance with Art. 32 GDPR, which ensure the level of protection for processing in Germany.
Stripe Payments Europe, Ltd.: Payment processing is carried out via Stripe Payments Europe, Ltd., headquartered in Ireland. Stripe processes payment data as a Processor in accordance with Art. 28 GDPR. Stripe’s parent company (Stripe, Inc.) is headquartered in the USA. Data transfer to the USA is carried out on the basis of the EU-US Data Privacy Framework and supplementary Standard Contractual Clauses (SCC). A Data Processing Agreement has been concluded with Stripe. Stripe has its own TOMs in accordance with Art. 32 GDPR.
No further external services: The flowgeist TOOL platform does not use external AI services, no external analytics services, and no further external services. The list of sub-processors is complete.
12. Change History
| Version | Date | Material Changes |
|---|
| 1.0 | 08.08.2026 | Initial version of the TOMs for flowgeist TOOL |