SimpleAct Logo
Trust Center

Security, Privacy & Compliance

SimpleAct runs its platform on certified infrastructure in Germany. All relevant documents for security and procurement reviews are available here.

GDPR Compliant
Data processing under EU law, server location Germany
Made in Germany
Developed and hosted in Germany, Hetzner Nuremberg
Hetzner ISO 27001
Hosted in an ISO 27001-certified Hetzner data centre

For Security & Procurement Reviews

Everything your security team or procurement needs for approval — centrally, complete, up to date.

DPA / AVV (Art. 28 GDPR)Page

Data processing agreement – full text available

View
SLAPage

Service level agreement with availability and response times

View
Security WhitepaperPage

Technical and organisational measures (TOM)

View
SubprocessorsPage

Listed in the whitepaper, full list on request

View
Architecture OverviewSection

Hosting, data flows, and isolation at a glance

View

Architecture Overview

SimpleAct – High-Level ArchitectureBrowser / ClientHTTPS · TLS 1.3Application Layer (EU)API / BackendAuth (RBAC, 2FA)Audit-LogMulti-TenantData Layer · EU – NurembergPostgreSQL (self-managed)Storage – Encrypted at restBackups (daily)Hetzner Nuremberg · EU data location · TLS in transitRBAC = Role-Based Access Control · 2FA = Two-Factor Auth (TOTP) · Append-only Audit-Log

Technical Details

Hosting & Infrastructure

  • Hosted at Hetzner (Nuremberg, Germany)
  • Database: self-managed PostgreSQL, also at Hetzner (Nuremberg)
  • Data location: EU — no third-country transfer
  • Automated daily database backups
  • Encryption at rest + in transit (TLS 1.2+)

Access & Authentication

  • RBAC — role-based access control
  • Multi-tenancy isolation between organisations
  • Two-factor authentication (TOTP)
  • Session invalidation on logout

Logging & Auditability

  • Append-only audit log of all actions
  • Document and entry versioning
  • Timestamped snapshots for regulatory evidence

Data Processing

  • GDPR-oriented processing
  • DPA/AVV available on request
  • Subprocessors listed transparently

Security Testing

  • Internal security review by the founding team (last: April 2026)
  • External security assessment by an independent, security-specialised freelancer (last: April 2026)

Security Whitepaper & TOM

Detailed description of all technical and organisational measures available for download.

View Whitepaper
← Back to homepage
Frequently asked questions

Everything you need to know about AI documentation

The most important questions on the documentation obligation, AI capture, and SimpleAct answered.

SimpleAct is hosted in an ISO 27001-certified Hetzner data centre. The certification applies to the data centre; corresponding technical and organisational measures are documented separately in the security whitepaper.
Yes: an internal security review by the founding team, plus an external security assessment by an independent, security-specialised freelancer.
In Germany at Hetzner (Nuremberg), with encryption at rest and in transit for all data. See the security whitepaper for architecture details.
Yes, a DPA under Art. 28 GDPR is available for download as part of the SLA/DPA bundle.

More questions? We're happy to help.

Get startedSend email
Security & Privacy at SimpleAct – ISO 27001 Hosting | SimpleAct