Skip to content
SimpleAct Logo

Trust Center

Security, Privacy & Compliance

SimpleAct runs its platform in an ISO 27001-certified data centre in Germany. All relevant documents for security and procurement reviews are available here.

GDPR-oriented operations
Data processing under EU law, server location Germany
Made in Germany
Developed and hosted in Germany, Hetzner Nuremberg
ISO 27001 data centre
Hosted in an ISO 27001-certified Hetzner data centre

For Security & Procurement Reviews

Everything your security team or procurement needs for approval — centrally, complete, up to date.

DPA / AVV (Art. 28 GDPR)Page

Data processing agreement – full text online, plus PDF (SLA + DPA)

View

SLAPage

Service level agreement with availability and response times

View

Security WhitepaperPage

Technical and organisational measures (TOM)

View

SubprocessorsPage

Hetzner, Stripe, Brevo and Anthropic (only if the AI assistant is switched on) – listed in the DPA with registered office, purpose and processing location

View

Architecture OverviewSection

Hosting, data flows, and isolation at a glance

View

Architecture Overview

Your team

Browser · API · TLS 1.2+

Identity provider

SSO · OIDC, SAML, LDAP

Germany · Hetzner · platform data in DE only

SimpleAct

Tenant isolation · roles

PostgreSQL

encrypted at rest

Backups

daily · Falkenstein

Audit log

append-only · every change with user and timestamp

Single sign-on

Sign in through your identity provider

Employees sign in with their existing company account. Roles come from your directory groups, and new users receive a defined default role on first login.

  • OIDC with PKCE for Microsoft Entra ID, Google Workspace and Keycloak
  • SAML 2.0 for SAML-capable identity providers
  • LDAP sign-in, e.g. against Active Directory
  • Role mapping from group claims to Admin, Editor and Viewer
  • SCIM provisioning from Entra ID or Okta

SSO from Professional · SCIM on the Enterprise plan

Technical Details

Hosting & Infrastructure

  • Hosted at Hetzner (Nuremberg, Germany)
  • Database: self-managed PostgreSQL, also at Hetzner (Nuremberg)
  • Platform data in Germany; payments processed via Stripe; if the AI assistant is switched on, Anthropic also processes the texts submitted to it in the USA (subprocessors and safeguards: see DPA)
  • Automated daily database backups
  • Encryption at rest + in transit (TLS 1.2+)

Access & Authentication

  • RBAC — role-based access control
  • Multi-tenancy isolation between organisations
  • Two-factor authentication (TOTP)
  • Single sign-on (OIDC, SAML 2.0, LDAP) and SCIM provisioning
  • Session invalidation on logout

Logging & Auditability

  • Append-only audit log of all actions
  • Document and entry versioning
  • Timestamped snapshots for regulatory evidence

Data Processing

  • GDPR-oriented processing
  • DPA under Art. 28 GDPR available as full text and PDF
  • Subprocessors (Hetzner, Stripe, Brevo, Anthropic (only if the AI assistant is switched on)) listed in the DPA

Security Testing

  • Internal security review by the founding team (last: April 2026)
  • External security assessment (last: April 2026); report available on request under NDA

Security Whitepaper & TOM

Detailed description of all technical and organisational measures available for download.

View Whitepaper
← Back to homepage

FAQ

Frequently asked questions on security & hosting

SimpleAct is hosted in an ISO 27001-certified Hetzner data centre. The certification applies to the data centre; corresponding technical and organisational measures are documented separately in the security whitepaper.
Yes: an internal security review by the founding team, plus an external security assessment. The report is available on request under NDA.
In Germany at Hetzner (Nuremberg), with encryption at rest and in transit for all data. Exception: if the AI assistant is switched on, Anthropic also processes the texts submitted to it in the USA. See the security whitepaper for architecture details.
Yes. The DPA under Art. 28 GDPR is available in full at simpleact.de/legal/avv-dpa and as a PDF download (SLA + DPA). The subprocessors in use (Hetzner, Stripe, Brevo, Anthropic (only if the AI assistant is switched on)) are listed there in section 5.

More questions? We're happy to help. Send email · Try 7 days (credit card required)