Share passwords and credentials in line with the GDPR
Anyone who accepts credentials from clients processes personal data and has to be able to show how. This page collects every document you need to assess Erseni Vault in one place.
Why this matters under the GDPR
A password sent by email stays in inboxes, on mail servers and in their backups, often for years. A one-time link that is encrypted in the browser and deleted on retrieval keeps the amount of personal data you hold small, and with it the damage if an account is ever compromised.
Documents for your assessment
Data protection
Our privacy policy: what data we process, on which legal basis and for how long.
Data Processing Agreement
DPA under Art. 28 GDPR including technical and organisational measures and our deletion concept.
Technical and organisational measures (TOMs)
The core measures that protect secrets handled by Erseni Vault.
Subprocessors
External providers that may process data on our behalf while operating the service.
Trust Centre
Every trust and compliance signal in one place.
Hosting in the EU
Servers and backups run at Hetzner in Germany, and the ciphertext of your secrets is stored there only.
Deletion concept
Hard deletion on first retrieval, expiry depending on your plan, backups overwritten after 7 days. The individual periods are set out in the DPA.
Zero-knowledge architecture
Encryption happens in the browser. The server receives only ciphertext and public keys and can never read the content.
Whether your use as a whole complies with the GDPR depends on your own processing. This page provides the documents, not that assessment.