Security you can show your auditor.
Built in the EU. GDPR-native. Ready for the NIS2 questions your customers will ask about their supply chain.
The facts, not the promises.
What you need when answering your customers' security questionnaires. No vague claims — just architecture and process decisions we can demonstrate.
Hosting & data residency
Production compute and databases are in the EU (Germany, Finland), on Hetzner infrastructure. Edge delivery via Cloudflare across EU points of presence. Some processors are established outside the EU; see the sub-processor list and the transfer safeguards in the Data Processing Agreement.
Encryption
TLS 1.3 for traffic between your browser and Keix (Let's Encrypt + Cloudflare). Traffic inside the cluster is on a private network and is not yet encrypted; in-cluster encryption is planned. Storage volumes are encrypted at the infrastructure provider level (Hetzner); customer-managed volume encryption is planned. Application credentials are held in cluster Secrets; a quarterly rotation and inventory programme starts once the current rotation is complete.
Identity & access
Authentication via Zitadel, with optional MFA (authenticator app or passkey). Role-based access control per module. Tenant isolation enforced at the application layer.
Application security
Every change goes through a pull request. Production merges need one reviewer, with a logged exception for designated administrators. Container image and filesystem vulnerability scanning (Trivy) and linting (Biome) run as blocking CI checks; type checking runs in the deployment build. Branch protection on production. Every change is auditable.
Observability & audit
Native event-sourcing across the core domain — every state change is an immutable event with a timestamp. A read-access log records who viewed or exported personal data. Telemetry via SigNoz (traces, errors, user flows). Logs and traces are retained for 15 days, metrics for 30 days.
Backup & disaster recovery
Continuous WAL archiving with daily base backups for Postgres, daily file-system backups of platform volumes, and daily search-index snapshots, all to Cloudflare R2 object storage (EU-jurisdiction migration planned; see the sub-processor list). No restore test has been performed yet.
Sub-processors
Cloudflare (edge & WAF), Hetzner (hosting), Zitadel (auth), Postmark (transactional email), Anthropic (LLM). Full list on our sub-processors page (/legal/sub-processors) and in the Security Whitepaper; DPA template ready, under legal review.
Vulnerability disclosure
Responsible disclosure policy at [email protected]. Acknowledgement within 48 hours, status update within 7 days.
NIS2 Supply-Chain Ready
Article 21 of NIS2 requires you to assess and contract the security of every ICT supplier. We provide a Security Whitepaper and a Data Processing Agreement template (art. 28, under legal review), audit log access, incident reporting commitments and the contractual clauses your supply-chain policy needs.