Security & Infrastructure – Technical and Organisational Measures

SimpleAct is operated as SaaS in a clear layered architecture. Access is only via encrypted connections (TLS). The application and data layers are within the EU (Germany, Hetzner Nuremberg). Exception: if the AI assistant is switched on, Anthropic also processes the texts submitted to it in the USA.

Components: (1) Client/browser over HTTPS, (2) Application layer with API, RBAC/2FA, audit log and multi-tenancy, (3) Data layer with PostgreSQL, encrypted storage and automated daily backups. All services run in the EU.

2.1 Data Centre and Data Location

Hosting is with Hetzner in Nuremberg (Germany). The database (PostgreSQL) is self-managed and also runs at Hetzner in Nuremberg. No US or non-European cloud providers are used for hosting or the database. Exception: if the AI assistant is switched on, Anthropic also processes the texts submitted to it in the USA (details in the privacy policy and DPA).

2.2 Backup Strategy

Automated daily database backups are created. Backups are held in Falkenstein (Hetzner). Retention periods and recovery procedures are defined and described in the DPA documentation.

2.3 Encryption

• In transit: All connections (client–server, server–database) use TLS (HTTPS).
• At rest: Data is stored with encryption at rest at the services used (database, storage).

RBAC

Access to functions and data is controlled via role-based access control (RBAC). Roles define which actions a user may perform; assignment is at tenant level.

Multi-Tenancy Isolation

Customer data is strictly separated by tenant. Queries and access are implemented so that no cross-tenant access to data is possible (tenant isolation at application and data layer).

2FA (TOTP)

Two-factor authentication (2FA) via TOTP (e.g. authenticator apps) is offered and can be enabled by users to further secure the account.

Session invalidation

Sessions are invalidated on logout. On password change or security-relevant actions, sessions can be terminated. Tokens are stored in httpOnly cookies to reduce XSS risk.

Append-only audit log

Security- and privacy-relevant events (e.g. login, changes to AI systems, exports, role changes) are recorded in an audit log. The log is append-only (no user-driven deletion or modification) to hinder tampering and ensure traceability.

Versioning & snapshotting

Where required by the product, changes are versioned (e.g. compliance documents, risk assessments). Snapshotting or point-in-time views can be used for exports and evidence.

Processing of personal data follows GDPR principles (lawfulness, purpose limitation, data minimisation, storage limitation, integrity and confidentiality). We maintain a record of processing activities under Art. 30 GDPR.

DPA / Data processing agreement (Art. 28 GDPR)

A data processing agreement (DPA) is available in full at simpleact.de/legal/avv-dpa and as a PDF download (SLA + DPA). Contractual arrangements for processing are in place with all subprocessors (e.g. Hetzner, Stripe, Brevo, Anthropic), or standard contractual clauses are used where required.

Subprocessors – transparency

The subprocessors (Hetzner, Stripe, Brevo and Anthropic, the latter only if the AI assistant is switched on) are listed with name, registered office, purpose and processing location in section 5 of the DPA at simpleact.de/legal/avv-dpa. Customers are informed of changes in line with contractual information obligations.

We rely on regular security measures in the development and operations process (e.g. dependency checks, secure configuration).

• Internal review: Security review by the founding team (last: April 2026).
• External review: External security assessment (last: April 2026); report available on request under NDA.

For questions on security and data protection: ….