Data Processing Agreement (DPA) pursuant to Art. 28 GDPR

Version and status of this document

Version of 1 October 2026. New versions take effect in accordance with the section "Liability and final provisions".

For questions regarding its content or for the conclusion of an individual data processing agreement, please contact hello@erseni.com.

Conclusion of this agreement

This DPA is concluded when a person authorised to represent the controller concludes it in the user account, stating the name of the company or organisation. The DPA is available on every plan, including the free plan.

Conclude the DPA in your user account

No DPA is concluded for use without a user account, as we cannot attribute such transactions to a controller. A user account is therefore required for business use.

Upon conclusion, we store the contracting party, the name provided, the version concluded, the language version and the time of conclusion, and we send the full text of the version concluded to the email address on file. The list of sub-processors and of the systems we operate ourselves that applies at the time of conclusion forms part of the concluded text as an annex and is stored and sent together with it. Conclusion by electronic means satisfies the requirement of electronic form under Art. 28 (9) GDPR; no signature is required.

Parties and subject matter of the processing

This data processing agreement (hereinafter the "DPA") sets out in detail the data protection obligations of the parties arising from the use of the service. It applies to all processing of personal data that we carry out on behalf of and on the instructions of the controller.

Controller

The controller within the meaning of Art. 4 (7) GDPR is the natural or legal person who uses the service and determines the purposes and means of that processing. In the case of business use, this is the using company or organisation stated upon conclusion.

Processor

Erseni Ltd, Private Company Limited by Shares
Archiepiskopou Makariou III, 59, MOUYIAS TOWER, 3rd floor, Flat/Office 301
6017 Larnaca, Cyprus
Registration number: HE 487031
Email: hello@erseni.com

Subject matter of the processing

The subject matter of the processing is the operation of a service for the end-to-end encrypted transmission of content (zero-knowledge approach). We provide the technical infrastructure through which encrypted content is stored, retrieved and deleted after retrieval or expiry. No analysis of the content takes place and none is technically possible for us.

In addition, our privacy policy applies to the processing operations for which we are ourselves the controller. In the event of conflicts between this DPA and the privacy policy, this DPA takes precedence.

Nature, scope and purpose of the processing

Nature of the processing

Collection, storage, transmission, provision and deletion of encrypted content and the associated technical metadata. The processing is carried out by automated means. Neither we nor any third party accesses plaintext content.

Purpose of the processing

The sole purpose is the contractual provision of the service: the secure one-time transmission of content between a sender and a recipient, the management of validity periods and the protection of the service against misuse and overload.

Duration of the processing

The processing takes place for the duration of the user relationship. Beyond that, encrypted content is processed only until the first retrieval or until the expiry of the selected validity period. Details are set out in the section on the deletion concept.

Categories of personal data

On behalf of the controller, we process the following categories of data:

Encrypted content (ciphertext), including optional encrypted file attachments. This may contain personal data of any kind; its selection is a matter for the controller alone. Without the client-side key it is not readable by us.
Technical metadata relating to the transaction: a randomly generated access token, the time of creation, the time of expiry, where applicable the time of retrieval, and an indication of whether the content can still be retrieved.
When used with a user account: the assignment of a transaction to the account and the events of the activity log (type of event, time, identifier of the account and identifier of the transaction, without content and without access tokens).
Notes that the controller voluntarily adds to a transaction. They are not encrypted on the client side and are readable to us.
When an organisation is used: the name of the organisation, the memberships and roles of its members, the email addresses of invited members for whom a user account is created with the invitation, where applicable the time from which the organisation is suspended, and the seat allowance.
Request templates of the controller, meaning template names and the labels of the requested fields, without the requested content.
API keys of the controller as metadata: name, prefix, a hash value of the key, the times of creation, last use and revocation, and usage counters. The key itself is not stored.

The controller decides on its own responsibility which content it transmits via the service. As the content is available to us solely as ciphertext, we can determine neither its category nor whether it relates to an identifiable person.

Processing under our own responsibility

The following processing operations, for which we are ourselves the controller, are not covered by this DPA. Our privacy policy applies to them.

The account data of account holders (email address, login data, account status and plan) for the performance of the user agreement.
Billing and payment data for paid plans. Payments are processed by Stripe as a controller in its own right.
Technical connection data for the security of the service and the prevention of misuse. For rate limiting, the IP address is not stored in plaintext but processed exclusively as a hash value derived using a secret key (HMAC-SHA-256), which is held in the cache only for the duration of the relevant time window.
Server access logs containing the IP address truncated before storage (without the last octet for IPv4, without the trailing part for IPv6), the time, the path requested, the status code, the volume of data transferred, the referrer and the user agent. They are deleted after 90 days.
The access token of a transaction is removed from the path requested before these logs are stored; the key in the URL fragment never reaches the server. The logs do not permit access to content.
Application logs of the service containing technical messages and errors, without content and without access tokens. They are deleted after 7 days.

Categories of data subjects

Users of the controller who create or request content via the service (for example employees and administrators).
Recipients to whom an access link is transmitted, as well as any persons whose data the controller includes in encrypted content.

Special categories of personal data

The service is not designed for the processing of special categories of personal data within the meaning of Art. 9 GDPR. As the content is encrypted client-side, such data may nevertheless be transmitted from a technical point of view. The lawfulness of such processing and compliance with the additional requirements of Art. 9 GDPR are the sole responsibility of the controller.

Processing on documented instructions

We process personal data solely on documented instructions from the controller, unless we are required to do so by Union or Member State law. In such a case we inform the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

Use of the functions that the service provides in the user account constitutes an instruction. Supplementary or deviating individual instructions must be addressed in text form to the contact address stated in the section "Version and status of this document".

We inform the controller without undue delay if, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. We are entitled to suspend the execution of such an instruction until it is confirmed or amended.

Owing to the zero-knowledge architecture, we are technically unable to carry out instructions that presuppose access to plaintext content. This applies in particular to instructions to disclose, rectify or examine the substance of encrypted content.

Personal data is processed in a third country or by an international organisation only to the extent that this is disclosed in the list of sub-processors and the requirements of Chapter V GDPR are met. The servers are located in a data centre in Germany and thus in the European Union. The processing of the encrypted content itself takes place exclusively within the European Union.

Where the controller is established outside the European Economic Area, the transfer of personal data from us to the controller is additionally governed by the standard contractual clauses pursuant to Implementing Decision (EU) 2021/914, Module Four (transfer processor to controller). We are the data exporter and the controller is the data importer. The information in this DPA on the parties, the subject matter, the categories of data and the data subjects constitutes Annex I, and the technical and organisational measures constitute Annex II, of the standard contractual clauses. In the event of conflict, the standard contractual clauses prevail.

Confidentiality of personnel

We ensure that all persons authorised to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality (Art. 28 (3) (b) GDPR).

The group of persons with administrative access to the production systems is limited to the minimum strictly necessary for operations.

The obligation of confidentiality continues to apply after the end of the respective activity and after the termination of this agreement.

Professional secrecy

If the controller is subject to a statutory duty of professional secrecy, for example as a lawyer or tax adviser, the following provisions apply in addition (Section 203 (3) and (4) of the German Criminal Code (StGB), Section 43e of the German Federal Lawyers' Act (BRAO), Section 62a of the German Tax Advisory Act (StBerG) and comparable provisions of other Member States).

We undertake, for ourselves and for all persons involved in providing the service, to maintain secrecy about third-party secrets that become known to us in the process, and we instruct these persons about the criminal consequences of a breach. We take note of third-party secrets only to the extent necessary to provide the service.

We have been instructed that the unauthorised disclosure of third-party secrets that become known to us as a contributing person is a criminal offence under Section 203 (4) StGB, and we hereby undertake in text form to maintain secrecy.

We only engage further persons or service providers to provide the service if we have in turn obliged them to maintain secrecy in text form and instructed them about the criminal consequences, or if they are subject to a corresponding statutory obligation. For the hosting provider, we provide evidence of this upon request.

The controller may verify compliance with these obligations as part of its audit rights under this DPA.

Content transmitted through the encrypted channel is not readable to us or our service providers. Secrets should therefore be entered only there and not in notes, template names or organisation names, which are readable to us.

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, we implement the technical and organisational measures described below in order to ensure a level of security appropriate to the risk. The central safeguard is the architecture itself: content leaves the end device only in encrypted form.

Encryption and pseudonymisation (Art. 32 (1) (a) GDPR)

Content is encrypted exclusively in the user's browser using AES-GCM with a key length of 256 bits before it is transmitted to the server. A separate, randomly generated 12-byte nonce is used for each transaction. Only the native Web Crypto interface of the browser is used. The command-line application we provide does not encrypt any content; it generates the key pair of a request on the device and decrypts the response there with the cryptography module of the Node.js runtime.
The key is generated client-side and transmitted in the fragment part of the URL after the hash sign. As a matter of principle, browsers do not send this part of a URL to the server, and it is therefore not known to us. If a password is additionally set, key material is derived from it using PBKDF2-SHA256 with 1,200,000 iterations and combined with the fragment key via HKDF-SHA256 to form an AES-GCM-256 key.
When content is requested, an X25519 key pair is generated on the end device of the requesting person. The responding party encrypts using an ephemeral X25519 key pair generated anew for each response and an AES-GCM-256 key derived via HKDF-SHA256. The private key does not leave the end device of the requesting person.
In our database, content exists solely as ciphertext. No plaintext exists on the server side at any time, not even temporarily during delivery.

Physical access control

The servers are physically operated in a data centre of Hetzner Online GmbH in Falkenstein, Germany. Access protection, video surveillance, fire protection and uninterruptible power supply are ensured there by the data centre operator; the corresponding evidence is available via the operator. We do not maintain our own premises with access to the controller's personal data.

System access control

Administrative access to the servers takes place exclusively via SSH using public key authentication; password login is disabled.
Administrative accounts are assigned on a named-person basis and limited to the group of persons required for operations.
Passwords of user accounts are stored solely as hash values using a computationally intensive procedure suitable for passwords. Access credentials and key material for services are stored in encrypted form and are not held in the source code.
The systems are protected by a firewall; only those services required for operations are reachable from outside. Database and cache services are not accessible from outside.

Data access control

Within the application there is a role-based authorisation concept. Access to a transaction requires knowledge of the randomly generated access token.
Only the data required for the purpose is collected. Activity logs contain neither content nor access tokens nor key material.
Access to plaintext content is technically impossible even with full administrative rights, as the key is not available on the server side.

Transfer control

All transmissions between the end device and the server take place exclusively via TLS-encrypted connections. Unencrypted requests are redirected to HTTPS.
The key required for decryption is never transmitted over the wire to the server, but remains in the URL fragment on the end device.
The application employs security-related HTTP headers, including a Content Security Policy and HTTP Strict Transport Security, in order to impede the execution of foreign code and a downgrade of the transport encryption.

Input control

For transactions assigned to a user account, an activity log is kept which records the type of event, the time at which it occurred, the identifier of the account and the identifier of the transaction. It contains neither content nor access tokens. For anonymously created transactions, no logging at transaction level takes place, for reasons of data minimisation.

Availability control and resilience (Art. 32 (1) (b) and (c) GDPR)

The application server with the database is backed up automatically every day. The backups of the last 7 days are retained; older backups are overwritten automatically. The backups are held by our hosting provider in the European Union. The self-operated systems for sending mail and for reach measurement are not backed up. Content is contained in them exclusively as ciphertext and is therefore not readable in the backups either.
The operating system and the components used are updated regularly; security-related updates are applied promptly.
Operations are monitored; disruptions and error conditions are reported automatically. A public status page shows the deployed build and the cryptographic procedures in use; it does not show the operating status.
Access limits are implemented to protect against automated attacks and overload. The counter keys used for this purpose are derived from the IP address using a secret key and are held in memory only for the duration of the relevant time window.

Separation control

Data of different projects is processed logically separated in dedicated databases. Production, staging and development environments are separated from one another; no production personal data is used in development environments.

Secure development

Changes to the source code undergo a review and are deployed via an automated pipeline.
Static code analysis and automated tests are used, which must pass without errors prior to deployment.
The third-party libraries used are pinned to fixed versions and are changed exclusively via the deployment pipeline. The deployment pipeline automatically screens those libraries for known vulnerabilities; a finding is reported and assessed by us, but does not stop the deployment.
The part of the service that is decisive for the encryption is open source and can be reviewed independently. In addition, we provide a reporting channel for security notices at "/.well-known/security.txt".

Testing and evaluation (Art. 32 (1) (d) GDPR)

The effectiveness of the measures is reviewed as and when required and upon material changes to the architecture, the systems or the sub-processors, and this document is updated accordingly.

Limits of the measures

We consider it part of a credible security commitment to also disclose what we do not provide:

We currently hold no certification under ISO/IEC 27001, no certification under Art. 42 GDPR, and we are not subject to any approved code of conduct under Art. 40 GDPR.
To date, no external security audit and no penetration test has been carried out.
Databases and backups are not additionally encrypted on the servers, unless otherwise agreed in the individual case.
To date, no independent cryptography audit has been carried out.
The encryption takes place in the browser and relies on the program code delivered by us. Anyone who does not trust our delivery must review the open source code themselves; a compromise of the delivery could defeat the end-to-end encryption.
Even though content is not readable by us, metadata is generated, in particular timestamps, expiry periods and the fact that a transaction exists. This metadata is known to us.

Sub-processors

The controller grants general written authorisation for the engagement of further processors within the meaning of Art. 28 (2) sentence 2 GDPR. The sub-processors engaged at the time of conclusion of the contract are set out in the separately maintained list and are deemed authorised. The systems we operate ourselves, which are listed there alongside them, are not sub-processors; the provisions of this section do not apply to them.

In addition to the hosting provider, we use systems that we operate ourselves: our own mail server for sending notifications, a self-hosted Matomo instance for reach measurement and a self-operated GitLab instance for technical error reports. They run on servers of the same hosting provider in Germany and are identified separately in the list as systems we operate ourselves. Matomo works without cookies, truncates the IP address by two bytes before storage and deletes the raw visit data after 180 days. Error reports contain technical information about the error and may contain personal data from the request concerned; we remove passwords and access keys before transmission. We retain error reports for as long as they are required for troubleshooting and for documenting it.

We impose on each sub-processor, by contract, the same data protection obligations as are incumbent on us under this agreement, and we remain liable to the controller for the sub-processor's compliance with the data protection obligations.

We inform the controller of any intended changes concerning the addition or replacement of a sub-processor at least 30 days in advance by email to the address on file and on the page listing the sub-processors. The controller may object to a change on data protection grounds in text form within this period. If the controller does not object in time, the change is deemed approved. If the controller objects, we do not use the new sub-processor for it, in so far as this can reasonably be expected of us; otherwise the controller may terminate this DPA and the underlying contract with effect from the date of the change without further cost. We refund on a pro rata basis any fees paid in advance for the period after termination.

Neither the sub-processors engaged nor the systems we operate ourselves obtain access to plaintext content. The hosting provider provides the infrastructure on which the ciphertext and the metadata readable to us (such as notes, organisation data and account data) are held; it does not obtain plaintext content. The remaining service providers process no transmitted content, but exclusively the data required for their respective purpose.

We use tools of external providers with which we have error reports or data from the service processed, in particular AI-based analysis tools, only if the provider is disclosed in the list of sub-processors, and only for the purpose stated there.

You will find the current list of sub-processors, including purpose, region and privacy information, here: List of sub-processors

Assistance with data subject rights

We assist the controller, in so far as this is possible, by appropriate technical and organisational measures for the fulfilment of its obligation to respond to requests by data subjects for the exercise of their rights under Chapter III GDPR (Art. 28 (3) (e) GDPR).

If a data subject contacts us directly, we forward the matter to the controller without undue delay, in so far as the request relates to processing carried out on its behalf. In such a case we do not respond independently.

We cannot comply with requests for access to, rectification of or disclosure of encrypted content, as the content is available to us solely as ciphertext; for the data readable to us, we assist the controller in accordance with the preceding paragraph. Deletion, by contrast, is possible at any time and also affects the ciphertext, which thereby becomes permanently unusable.

We further assist the controller in complying with the obligations under Art. 32 to 36 GDPR, in particular with a data protection impact assessment and any prior consultation of the supervisory authority, and make the information available to us available for this purpose.

We provide the assistance services free of charge to the customary extent. For any effort going beyond this that is not attributable to a circumstance for which we are responsible, we may claim reasonable remuneration; we give advance notice of this.

Notification of personal data breaches

We inform the controller without undue delay, and at the latest within 48 hours, after becoming aware of a personal data breach that occurred in the course of the processing on its behalf (Art. 33 (2) GDPR). The notification is sent in text form to the email address that was on file when this DPA was concluded or that the controller has notified to us since.

The notification contains, in so far as known to us, a description of the nature of the breach, the categories and approximate number of records concerned, the likely consequences and the measures taken or proposed. Where not all information is immediately available, we provide it without undue delay thereafter.

We take the necessary measures without undue delay to secure the data and to mitigate possible adverse effects, and we agree any further measures with the controller.

The notification to the supervisory authority under Art. 33 GDPR and the communication to data subjects under Art. 34 GDPR are incumbent on the controller. We do not make such notifications independently on behalf of the controller, but we support it in doing so.

Security incidents and vulnerabilities may be reported at any time to hello@erseni.com and via the reporting channel published at "/.well-known/security.txt".

Deletion and return after the end of the contract (deletion concept)

The service is built such that deletion is the rule and retention the exception. Below we describe which data is deleted when and in what manner.

Deletion upon first retrieval

When content is retrieved, the record is read and at the same time physically removed from the table in a single atomic database operation. The delivered content thereafter exists only transiently in memory for the duration of the delivery. A second retrieval of the same link is thereby impossible. We cannot restore the ciphertext from the live system; it may remain in the backups for up to 7 days after deletion, where it is not readable without the key, which was never available to us. We restore backups only to recover the system as a whole after an outage, never to retrieve individual transactions.

Maximum retention period for content that is not retrieved

If content is not retrieved, it can no longer be retrieved once the validity period selected by the controller expires and is permanently deleted in the next nightly deletion run. The maximum period that can be selected depends on the plan used:

Free use and use without a user account: a maximum of 7 days
Pro plan: a maximum of 30 days
Business plan: a maximum of 30 days

Within these maximum limits the controller may select a shorter validity period; the shortest selectable period is one minute. An extension beyond the stated maximum limits is technically impossible.

Automated deletion of expired data

An automated deletion run removes expired records daily within a night-time window. Deletion takes the form of definitive removal from the database in batches; there is no marking as deleted and no recycle bin. It covers expired content, expired requests, expired status metadata and technical auxiliary data used for the prevention of misuse.

Status metadata and grace period

After content has been deleted, a purely status-related record remains for a grace period of 24 hours from expiry, so that the fate of a transaction remains traceable and a link that has already been retrieved does not incorrectly appear as unknown. This record contains only the type of transaction, the access token, the time of creation, the time of expiry and, where applicable, the times of the response and of the retrieval. It contains no ciphertext and no key material. Upon expiry of the grace period this record is deleted as well; the assignment of a transaction to a user account is automatically deleted along with it.

Account data and activity log

Activity log entries are deleted automatically once they are older than 90 days; a daily deletion run removes them permanently from the database. Account data is stored for the duration of the user relationship. If the controller deletes their user account, we immediately delete the assignment of transactions to the account, the notes, the request templates, the API keys, the contract conclusions, the organisation with its memberships, the activity log, the role assignment and the account settings; the account itself is anonymised. User accounts created with an invitation for members remain in place as those persons' own accounts, even if they were never activated. Content not yet retrieved remains as ciphertext we cannot read until it expires and is then deleted in the nightly deletion run. The customer record with the payment service provider and the invoices are retained for the duration of the statutory retention obligations; their processing is restricted to the fulfilment of those obligations.

Backups

The application server with the database is backed up automatically every day; the self-operated systems for sending mail and for reach measurement are not backed up. The backups of the last 7 days are retained; older backups are overwritten automatically. A deleted record is therefore removed from all backups no later than 7 days after its deletion; records are not deleted individually within existing backups. The transaction logs of the database are continuously overwritten during operation and are not archived. As content is held in backups exclusively as ciphertext and the corresponding key was never known to us, it is not readable there.

Return and deletion after the end of the contract

After termination of the contract, at the controller's choice, we either hand over the data processed on its behalf, in so far as it is available to us in readable form (notes, activity log, request templates and organisation data), in a common machine-readable format or delete it, no later than 30 days after the end of the contract and unless Union or Member State law requires its retention. If the controller makes no choice, we delete the data. If the controller deletes its user account itself, this counts as choosing deletion; the data is then deleted immediately. We cannot hand over encrypted content, as it has either already been retrieved and thus deleted or is held exclusively as ciphertext that we cannot read; ciphertext not yet retrieved remains until it expires.

Upon request we confirm the deletion to the controller in text form.

Evidence and audit rights

We make available to the controller all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller (Art. 28 (3) (h) GDPR).

Evidence is provided primarily by presenting this documentation, the description of the technical and organisational measures, the list of sub-processors and the evidence made available by our service providers.

Where the controller considers this evidence insufficient in an individual case, we allow an on-site audit subject to reasonable advance notice, as a rule no more than once per calendar year (more frequently where there is a specific reason or at the request of a supervisory authority), during normal business hours, without disruption to operations and while preserving confidentiality towards other customers. The mandated auditor must not be in competition with us.

Beyond the contractual evidence, the program code decisive for the encryption can be inspected and reviewed independently as open source code. We regard this as an essential element of demonstrating compliance.

We expressly point out that we are currently unable to present any certification or external audit report that would replace an audit by the controller.

Relationship to the General Terms and Conditions

This DPA conclusively governs the processing of personal data on behalf of the controller. All other matters of use are governed by the General Terms and Conditions of the service (hereinafter the "Terms") in the version accepted by the controller. In the event of conflicts, this DPA takes precedence in so far as it concerns the processing of personal data on behalf of the controller; otherwise the Terms take precedence. For damage other than damage arising from the processing of personal data on behalf of the controller, the liability provisions of the Terms apply. If the controller has not accepted the Terms, the provisions of this DPA on liability, term, choice of law and place of jurisdiction also apply to the user relationship.

Liability and final provisions

Liability towards data subjects is governed by Art. 82 GDPR. For damage arising from the processing of personal data on behalf of the controller, we are liable, as between the parties, without limitation for intent and gross negligence, for damage resulting from injury to life, body or health, in cases of fraudulent intent, in so far as we have given a guarantee, and under mandatory statutory provisions. In cases of simple negligence, we are liable only for the breach of an essential contractual obligation, the fulfilment of which makes the proper performance of the contract possible in the first place and on the observance of which the controller may regularly rely, limited to the damage that is typical for the contract and foreseeable and to the fees paid by the controller in the twelve months preceding the damaging event, but to no less than 500 euros. If we or the controller are held liable by a data subject under Art. 82 GDPR, each party bears, as between the parties, that part of the compensation which corresponds to its share of responsibility for the damage (Art. 82 (5) GDPR); the above limitations do not apply to this apportionment. Administrative fines are borne by the party on which they are imposed.

The controller is solely responsible for the lawfulness of the processing, for the lawfulness of the content it transmits and for the secure forwarding of the access links and any passwords to the intended recipients. If an access link is disclosed to unauthorised persons by the controller, its users or the recipients, we are not responsible for this.

The user relationship within the meaning of this DPA is the use of the service via the controller's user account under the General Terms and Conditions in the version accepted by the controller; where the controller has not accepted any, it ends upon deletion of the user account or upon termination by either party in text form with a notice period of 30 days. This DPA applies for the duration of the user relationship and ends together with it. The provisions on confidentiality and on deletion continue to apply beyond that.

We may update the description of the technical and organisational measures, provided that the level of protection is not thereby reduced; for sub-processors, the procedure set out in the section "Sub-processors" applies. Any other new version of this DPA takes effect only once the controller concludes it; until then, the version concluded applies.

Amendments and supplements to this DPA must be made in text form. This also applies to any waiver of this formal requirement.

Should individual provisions of this DPA be or become invalid, the validity of the remaining provisions shall remain unaffected. The parties shall replace the invalid provision with a valid provision that comes closest to its economic and data protection purpose.

This DPA is governed by the laws of the Republic of Cyprus, excluding the UN Convention on Contracts for the International Sale of Goods; mandatory provisions of the GDPR remain unaffected. The exclusive place of jurisdiction for all disputes arising from this DPA is Larnaca, Cyprus, provided that the controller is a business, a legal entity under public law or a special fund under public law. The competence of the data protection supervisory authorities remains unaffected.

This DPA is available in German, English and French. In the event of discrepancies between the language versions, the German version prevails.

Annex: Sub-processors and systems we operate ourselves

List as of: 26 September 2026

The list sets out all sub-processors and systems we operate ourselves that we use for the services provided under this DPA. Entries marked "Only for ..." relate exclusively to the applications named there. The authorisation under the section "Sub-processors" extends only to those sub-processors that actually act for the controller's service; for a service that does not include an application, we do not use the sub-processors disclosed for that application and do not transfer any of the controller's data to them.

Sub-processors engaged

Hetzner Online GmbH: Operation of the servers and the database, storage of the encrypted content and the associated metadata, and domain name resolution (DNS). Falkenstein data centre, Germany (EU). Privacy information DPA
Stripe Payments Europe, Ltd.: Processing of payments and subscriptions for paid plans. For payment data, Stripe is a controller in its own right and not a sub-processor; we list Stripe here for the sake of completeness. No access to transaction data or transmitted content. Ireland (EU). Any processing in the USA is based on the EU-US Data Privacy Framework and, in the alternative, on the standard contractual clauses of the European Commission (Implementing Decision (EU) 2021/914). Privacy information

Systems we operate ourselves (not processing by a sub-processor)

Stalwart Mail Server: Dispatch of transactional email notifications, such as the notice that a request has been answered. The notifications contain no content. Instance operated by ourselves on rented infrastructure in Germany (EU); no external email service provider. Privacy information
Matomo Analytics: Cookieless reach measurement of the public pages and the logged-in area with a truncated IP address; raw data is deleted after 180 days. Used exclusively in the production environment and processes no content and no transaction data. Instance operated by ourselves on rented infrastructure in Germany (EU); no disclosure to third parties. Privacy information
GitLab: Recording of technical error reports for the purpose of fault resolution. Recorded are the error text, the call path and technical environment data; decrypted user content is not transmitted. Instance operated by ourselves on rented infrastructure in Germany (EU); no external service provider. Privacy information