Technische und organisatorische Maßnahmen (Art. 32 DSGVO)

The measures comprise the application-related TOMs of Datenmaske (a dedicated ISO/IEC 27001-certified ISMS is in preparation, target 2027) and the infrastructure-related TOMs of the hosting provider netcup (data center Nuremberg; the data center is certified according to ISO/IEC 27001 — data-center-only). The primary processing locations are within the European Union: hosting with netcup in Nuremberg as well as Microsoft Azure for OCR and a technical NER fallback stage in configured EU regions. Agreements pursuant to Art. 28 DSGVO are in place with the sub-processors (model draft available at /avv).

Note: The measures described here apply to the existing Datenmaske application (general GDPR / Art. 32 layer). They do not cover processing of professional secrets protected under § 203 StGB; this is reserved for a separate product edition.

1. Encryption (transmission and storage)

• TLS-encrypted data transmission (HTTPS) for all connections between browser, public API, and application infrastructure; unencrypted cleartext protocols are excluded.
• Storage on EU servers with disk-level encryption by the hosting infrastructure (netcup, data center Nuremberg). Note: There is no application-side field-level encryption of individual database columns; encryption of data at rest is ensured at the infrastructure level.
• All document transmission runs exclusively over encrypted connections.

2. Access control and authorization control

• Password-based, session-bound authentication via secure HttpOnly cookies; no passwordless or universal master access.
• Strict tenant separation at the record level: all application data (documents, redaction suggestions, actions, audit logs, settings) is stored separately per authenticated user and read out exclusively for the authorized owner.
• The administration function is triple-secured and completely deactivated in production (the interface responds with 404, its existence is not revealed).
• The public API is authenticated exclusively via personalized API keys; keys are stored only as one-way hashes and are not reconstructable.
• Comprehensive audit logging for upload, suggestion review, redaction, export, and deletion per user and document.

3. Key management

• API keys are stored exclusively as one-way hashes; the plaintext is shown once on creation and is not reconstructable afterwards.
• A short key identifier (prefix and first characters) serves for identification in support cases without disclosing the key itself.
• Before any persistence of error and context logs, values with sensitive key names (e.g. secret, password, token, API key) are removed automatically and recursively.
• Passwords are stored using industry-standard one-way hash functions; session tokens are rotated regularly.
• A maximum of five API keys per user, revocable at any time and with an optional expiry date.

4. Incident response (incident management)

• Centralized, timestamp- and source-structured recording of disruptions and errors (e.g. authentication, email, webhook, OCR, detection, redaction, export).
• Server-side errors are written automatically into the incident recording.
• Processing errors in the email, webhook, export, and OCR paths are reported via a central error function.
• Incident insight is possible only locally via the triple-secured, in-production-deactivated admin tool.
• The contractual notification of the controller in the event of personal data breaches pursuant to Art. 33 DSGVO is codified in the DPA.

5. Backup, restore, and availability

• Availability and backup measures at the infrastructure level in accordance with the agreed scope of services of the hosting partner netcup (data center Nuremberg; data-center-only — no certification of the Datenmaske application). Datenmaske does not operate a separate application-level document backup.
• On the application side, Datenmaske operates active data deletion instead of an application-level backup: uploaded documents are automatically physically deleted after the retention period expires (default 30 days, configurable).
• Audit logs are retained without document contents; the tier-specific retention (Starter 30 / Solo 180 / Professional 180 / Business 365 days) is fixed per record and automatically enforced.
• Uninterruptible power supply and climate control concepts in the data center (netcup).
• Separation of production and development environments.

6. Redaction-specific integrity measures

• Irreversible physical removal of the redacted text from the PDF (content stream removal) — not a mere visual overlay; the text is structurally no longer contained in the document.
• Fail-closed verification: after redaction, the document is automatically re-checked to confirm that marked texts are no longer extractable. If verification is not possible, it fails instead of feigning success.
• On export, all metadata (title, author, creation date, among others) is removed.
• For scanned (OCR-based) documents, verification is limited to the text layer; the pixel layer is not automatically verified. Users are instructed to perform a manual review (known limitation, hardening in progress).
• Separate redaction log as a standalone PDF with dual SHA-256 checksums (original and redacted file) for each export transaction.

7. Vulnerability management and software lifecycle

• Continuous monitoring of software dependencies for known security vulnerabilities by means of dependency scans as well as pinning of critical packages.
• Strict code quality and typing requirements with automated static checks as a mandatory pre-commit and merge gate.
• Code review before every merge plus manual static code inspection. Note: An automated SAST/DAST pipeline in the sense of a SOC 2 DevSecOps program does not currently exist; the measures are manual plus dependency scan.
• The regular AI detection is self-hosted; Azure is used for OCR and optionally as a technical NER fallback stage. If external or self-hosted detection fails, the rule-based detection remains and the user must review suggestions manually.

Penetrationstest

Kontakt & weiterführende Unterlagen

Den vollständigen Auftragsverarbeitungsvertrag (AVV) samt Anlage zu diesen Maßnahmen sowie die AVV-Änderungshistorie finden Sie auf den entsprechenden Seiten. Einen kompakteren Überblick über Sicherheit & Datenschutz bietet die Seite Sicherheit & Datenschutz .