Security and data protection.
ProofPass runs in data centres in Frankfurt am Main. Every record belongs to exactly one manufacturer, and access rules keep the accounts apart. Passwords, API keys and access tokens are stored only as hashes. The data processing agreement, which you conclude with one click in the dashboard, governs who processes your recipients’ email addresses.
As of 11 November 2026. The contracts referred to here are available in German.
Where your data is stored
- Hosting and file storage: Vercel Inc., data centre in Frankfurt am Main (region fra1).
- Database: Neon Inc., data centre in Frankfurt am Main.
- Email delivery: easyname GmbH, Austria.
These are the sub-processors listed in section 6 of the data processing agreement (German). Standard contractual clauses apply to Vercel and Neon (based in the USA). We announce new sub-processors by email at least four weeks in advance. Paid plans are billed through Stripe, which acts as a separate controller for the payment; we never receive full card details. Everything else, including cookies, is in the privacy policy (German).
Technical and organisational measures
- Encrypted transport (HTTPS) and an encrypted database connection.
- Tenant separation: every record carries its manufacturer. Access rules prevent access to other manufacturers, and every action in the dashboard also checks that the record belongs to your account.
- Passwords only as hashes. You see an API key exactly once; only its SHA-256 hash is stored. Access tokens for AI assistants (OAuth 2.1 with PKCE) are also kept only as hashes.
- Personal delivery links and upload links for suppliers carry random identifiers that cannot be guessed. Recipients unsubscribe with one click.
- Files your suppliers upload are not public: only your account can read them, and they are stored under random file names.
- Sign-up, password reset, the API (120 requests per minute and key) and the access for AI assistants are rate-limited.
- The agency (EA Digital Solutions e.U.) accesses accounts only for support and operations.
Your documents stay unchanged
A new version does not overwrite the old one; the old one moves to the version archive. On upload we calculate a SHA-256 checksum for every file. With it, anyone can check under Verify a document whether a data sheet was published unchanged and is still current; the file never leaves the browser.
Backups
The database operator backs up the database regularly (section 5 of the data processing agreement).
Taking your data with you and deleting it
In every plan you can download everything as a ZIP under “Prüfmappe” (audit pack) in the dashboard: products, documents and their versions, recipients and delivery records. When the contract ends we delete the data at your request, unless a legal duty to keep it applies (section 8 of the data processing agreement).
Service status
The address /api/health answers with a short JSON response while the application is running. You can add it to your own monitoring. We do not state a guaranteed availability (terms, German, section 6).
Reporting a vulnerability or a data protection incident
Write to office@proofpass.eu with the subject “Security” and describe what you found. If an incident affects your recipients’ data, we tell you without undue delay, if possible within 48 hours of becoming aware of it (section 7 of the data processing agreement).