Attachment to the company data information September 26, 2026
Technical protective measures
Access and separation
Public connections to the application use HTTPS. The central web server sets additional security headers. The examined app container has a read-only system drive; operational data is stored in separate writable directories. The database is not directly publicly accessible in the operational template.
Company, user and role rights are checked on the server side. Mailboxes, private documents and chat channels have additional access rules. Companies use a common infrastructure; Logical tenant separation is not a physical individual server separation. Necessary administrative access for operation and troubleshooting remains possible.
Secrets and transmission
Passwords are processed as checksums. One-time links and sessions are time-limited. The central AI key is stored in encrypted form and is not displayed on the normal company interface. Document archives and company backups use their own encrypted storage formats; This does not imply a promise that every database value or file is end-to-end encrypted. The server must be able to decrypt authorized content for display and processing.
The central STRATO email dispatch is set to encrypted SMTP transmission. Recipient choice, approvals and external services set up determine where data then goes. Even encrypted transmission does not replace recipient verification.
Backup and restore
Separate, encrypted emergency backups are set up every six hours for the database and files. There are also company-specific security points. The last checked central backup was successful on September 26, 2026. This status is a snapshot, not a promise of uninterrupted availability or a fixed maximum data loss.
Company administrators can only restore their own company inventory. A full productive platform restore requires a separate host-side release. The application alone cannot grant this permission. Additional protective copies and different storage options are available in the Deletion instructions described.
Traceability and tests
Safety-relevant and operational processes are logged depending on the area. Automated checks cover, among other things, client separation, rights, repetitions, conflicts and backup processes. They do not replace independent security certification or the control of organizational measures, end devices and service provider contracts.
The acknowledgment of the data protection information is saved with the text version, time and associated identity when access is requested and activated. An unverified form alone does not prove who actually made the request. The verified email and activation are therefore documented separately.
Organizational responsibility
Binding arrangements for processing data on behalf of a controller include documented instructions, confidentiality obligations, an access-control model, regular checks, a procedure for data protection incidents and defined deletion rules. Evidence of these organisational measures cannot be established from source code alone; they must be implemented in actual operation.
Your company manages its own access, roles, devices and approvals. Remove permissions that are no longer required and report suspected data protection incidents or incorrect releases without unnecessary delay info@sc-v.de. First send the process reference and error description instead of unprotected complete mail archives or access data.