Technical and organisational measures
As of September 2026 · Annex 2 to the data processing agreement (Art. 32 GDPR)
This document describes the measures with which we protect the data processed in FirmaCenter. It forms an annex to the data processing agreement and is updated whenever there are material changes.
Access control
Every login uses a personal account with its own e-mail address; shared accounts are not provided for. Passwords are stored as hashes only and cannot be read by us. Sessions expire automatically and can be ended by the account holder.
Authorisation and separation of tenants
Companies are separated in the database itself rather than in the interface: every query is restricted to the company concerned by row level security rules. In addition, the server checks the requester’s permission on every call. Service keys with elevated rights are used on the server only and are never present in the app or the browser. Within a company, the assigned role determines which data is visible.
Encryption
Data is transmitted over TLS-encrypted connections only. The database, file storage and backups are encrypted at rest by the data centre operator. Uploaded files are held in a non-public storage area; access is only possible through time-limited links checked against the requester’s permissions.
Input control and accountability
Records carry the time of creation and change and the person who caused it. Security-relevant operations in the administration area are logged. Issued invoices cannot be altered once finalised; corrections are made through separate correction documents.
Availability and recoverability
The database and file storage are backed up regularly by the data centre operator; restoring them is part of our documented operating procedures. The mobile app continues to work without a connection and reconciles changes once connectivity returns — a loss of connection does not cause data loss on the device.
Resilience and abuse protection
Publicly reachable functions are protected against automated bulk requests (call limits, detection of automated submissions). Individual endpoints have an emergency switch that allows them to be disabled immediately on suspicion, without interrupting the rest of the software.
Organisational measures
Access to production data is limited to those who need it for their task; they are bound to confidentiality. Written procedures exist for exchanging keys and credentials and for handling a security incident. Changes to the software pass automated checks before release.
Processor control
We have data processing agreements under Art. 28 GDPR in place with every service provider we use. Who those providers are, what they are used for and where they process the data is set out in the list of sub-processors.