Security & Data Protection

Your data stays in Germany

EVOAR Social runs on a Hetzner cloud server in Nuremberg. You sign the data processing agreement directly in the app, including all sub-processors and protective measures.

AVV ansehenSub-processors

Server in Nuremberg

Cloud server at Hetzner's Nuremberg data center. No hosting abroad.

Data stays in Germany

Database, files and daily backups are all stored on the same server in Germany.

Encrypted end to end

Transmission via HTTPS only, passwords with Argon2id, access keys with AES-256-GCM.

Two-factor login

Available for every login and can be made mandatory for the whole team.

Hosting

One server, one location: Nuremberg

The application, database, uploaded files and backups are hosted by Hetzner Online GmbH in its Nuremberg data center. Hetzner is ISO/IEC 27001 certified. The database and file storage cannot be reached from the internet, only the application itself via HTTPS.

We back up the database and files every night. After your contract ends, you can request an export for 30 days, after which we delete everything.

Roles and privacyAdmins manage the company. Drafts and ideas in a personal profile are visible only to that person.
Approval before publishingIf you wish, no post goes out without approval. External reviewers get a time-limited link, not an account.
Devices at a glanceEveryone can see their logged-in devices and sign them out. We announce new logins by email.
Sparing use of AIOnly what the respective feature needs is sent to AI providers, and no IP addresses. You decide what gets published.
Transparency

Sub-processors

These service providers process data on our behalf. For the AI features, data is transferred to the USA; we say so openly and safeguard it with EU Standard Contractual Clauses. We announce changes four weeks in advance.

Hetzner Online GmbHIndustriestr. 25, 91710 Gunzenhausen, Germany
Hosting of the application, database, files and backups
Deutschland (Rechenzentrum Nürnberg)
OpenRouter, Inc.169 Madison Avenue, New York, NY 10016, USA
Forwarding of AI requests to the model providers
USAEU Standard Contractual Clauses (Art. 46(2)(c) GDPR)
Anthropic PBCSan Francisco, California, USA
Language models for texts and analyses (via OpenRouter)
USAvia OpenRouter, EU Standard Contractual Clauses
Google LLC1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
Transcription of audio and video files (via OpenRouter)only for audio/video import
USAvia OpenRouter, EU Standard Contractual Clauses
Perplexity AI, Inc.San Francisco, California, USA
Research for the Trend Radar (via OpenRouter)only when using the Trend Radar
USAvia OpenRouter, EU Standard Contractual Clauses
Google Ireland LimitedGordon House, Barrow Street, Dublin 4, Ireland
Sending emails (Google Workspace)
EU, transfer to the USA possibleEU-US Data Privacy Framework (Art. 45 GDPR)
Stripe Payments Europe, Limited1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland
Payment processing and invoices
EU, transfer to the USA possibleEU-US Data Privacy Framework (Art. 45 GDPR)

Only if you use them yourself: LinkedIn Ireland Unlimited Company · Google / LinkedIn (login) · Push services of browser vendors (Google, Mozilla, Apple) · Anthropic (Claude, MCP).

Art. 32 GDPR

Technical and organizational measures

Physical access control

  • Operated exclusively in data centers of Hetzner Online GmbH (Nuremberg location) with access control, video surveillance and security personnel; Hetzner is ISO/IEC 27001 certified.
  • No physical access to the hardware by the provider is required.

System access control

  • Passwords are stored hashed with Argon2id; minimum length 12 characters.
  • Two-factor login (TOTP) with recovery codes; customers can make it mandatory for all members.
  • Login attempts are limited per user and IP address; email notification when logging in from a new device.
  • Sessions expire after 12 hours of inactivity (after 30 days with "Stay signed in"); session identifiers are stored only as hashes; users can see and end their own sessions.
  • The database and file storage cannot be reached from the internet; only the web server is publicly accessible, via HTTPS.
  • Administrative server access only by the provider; root access only with an SSH key.

Data access control

  • Strict tenant separation: every query is bound to the customer account.
  • Role model with admins and employees; the content of a personal profile is visible only to its owner, content of the company channel only to admins.
  • Access keys for LinkedIn are stored encrypted with AES-256-GCM; access tokens for interfaces (MCP) only as hashes.
  • Approval links for external reviewers are random, time-limited and can be revoked at any time.

Transfer control

  • Data is transmitted exclusively in encrypted form (HTTPS/TLS).
  • Data is only passed on to sub-processors to the extent described (Annex 2); no user IP addresses are transmitted to AI providers.

Input control

  • AI requests are logged with the triggering user, function and model (content is deleted after 90 days).
  • Changes to posts can be traced via status, comments and approvals; notifications document approvals and publications.

Availability control

  • Daily backup of the database and files (03:30); database backups are retained for 14 days.
  • Automatic operating system security updates; the application runs in separate containers.

Separation control

  • Logical separation of customer data via the customer account ID in all tables and file paths.
  • Separate environments for development and production; development uses test data only.

Procedure for regular review

  • Regular updates of the software and libraries in use.
  • Review of these measures in the event of significant changes, and at least once a year.

DPA, security questionnaire, questions?

You can sign the DPA in the app under Settings → Datenschutz & AVV and save it as a PDF. For questionnaires from your IT or data protection department, just drop us a line.

AVV lesenhello@evoar.de