We use Google Analytics to understand usage anonymously and improve DataVault. Analytics cookies are only set with your consent. Technically necessary cookies (sign-in) are unaffected. More in the privacy policy.
Trust Center · As of 2026‑08‑22
Transparent information on DataVault’s infrastructure, data protection, security measures, and independent audits.
Hosting
AWS EU
Primary region eu‑central‑1
AI processing
Bedrock EU
EU Geographic Inference Profiles
Retention
S3 Object Lock
Compliance Mode, configurable term
Assurance goal
SOC 2 Type II
Scope/gap phase
Our approach
DataVault processes confidential company records — contracts, invoices, customer data. Tenant isolation, encryption, tamper resistance, and retention are built into the database and application layer from the start.
This page describes each control, its status, scope, and next step — separated by what is implemented today, what is being built, and what has been externally audited or certified. We use the label “certified” exclusively for certifications that actually exist.
Trust does not come from a seal, but from being able to verify what stands behind it.
Infrastructure & data location
DataVault runs its primary infrastructure in AWS eu‑central‑1 (Frankfurt). For AI processing we use AWS Bedrock inference profiles geographically restricted to the EU; inference processing may take place within the designated AWS regions of the EU geography.
Serverless architecture (Lambda, RDS, S3, CloudFront). No own data center, primary region Frankfurt.
Classification, extraction, embeddings, and chat run through AWS Bedrock EU Geographic cross‑region inference profiles. Processing within the designated AWS regions of the EU geography.
Row‑level security with FORCE‑RLS on all tenant‑related tables. Every request runs under an explicit tenant context — deny‑by‑default, complemented by additional authorization checks in the application layer.
Encryption & verifiability
Encryption
Verifiability & retention
Terms such as “GoBD‑oriented” mean that our retention logic aligns with the GoBD principles. We deliberately do not use the phrase “GoBD‑compliant”, because a compliance assessment is a legal judgment that we do not make here. Likewise, a technical WORM retention setting on its own is not a legal basis for storing personal data.
Access & organization
Owner → Admin → Member → Viewer. Plus a separate operator panel via email allowlist, kept apart from customer access.
Add‑on modules (e.g. collaboration, signatures) are enabled per tenant by the owner or operator — not self‑service, no accidental access.
CI gates with more than 1,300 automated tests before every release; code review as an integral part of the development process.
A formalized onboarding/offboarding process and regular, documented access reviews are being built — part of our SOC 2 readiness.
Availability & contingency
Today
In progress
Compliance roadmap
DataVault currently addresses primarily private‑sector customers. That is why we deliberately prioritize SOC 2 Type II as our first independent assurance evidence; we are preparing C5 in parallel and will pursue the independent audit as soon as public‑sector clients or corresponding tenders become relevant.
Honest status:There is currently no SOC 2, ISO 27001, or C5 attestation. The C5:2020 requirements catalogue serves us internally as a frame of reference, but it is not a C5 certification and not “BSI‑certified”. AWS certifications cover the infrastructure, not the DataVault application layer. SOC 2 Type II is our first external assurance goal — not a status already achieved, and never to be described as “SOC 2 certified”.
Cloud & AI services in use
This table shows the cloud and AI services used technically. It is not an exhaustive legal list of sub‑processors — which services constitute a separate sub‑processor in a given case depends on the contractual and data processing relationships that actually exist.
| Service | Purpose | Region / profile | Data category |
|---|---|---|---|
| Amazon Web Services (AWS) | Hosting, database, object storage, message queues | eu‑central‑1 | All customer data |
| AWS Bedrock — Anthropic models | AI chat, classification, entity recognition | EU Geographic Inference Profile | Document contents for inference processing under the AWS data processing terms applicable to Amazon Bedrock |
| AWS Bedrock — Cohere models | Embeddings, reranking | EU Geographic Inference Profile | Document contents for inference processing under the AWS data processing terms applicable to Amazon Bedrock |
| AWS Textract | OCR for scanned documents | eu‑central‑1 | Document contents |
| AWS SES | Email import & delivery | eu‑central‑1 | Email metadata & attachments |
We provide business customers with a currently maintained list of the sub‑processors relevant to DataVault as part of the contractual and data protection documentation (including the DPA).
Data protection
Requests under Art. 15 (access) and Art. 17 (erasure) GDPR are processed. Deletable and derived data is removed; for immutably archived originals, applicable statutory retention obligations, legal holds, and exceptions to the right to erasure are taken into account in the respective processing context.
A data processing agreement (DPA) pursuant to Art. 28 GDPR is provided for every business customer and can be reviewed before the contract is concluded.
Documents subject to ongoing legal proceedings can be exempted from regular deletion — logged in a traceable manner.
Frequently asked questions
Questions about security?
For security reports, reach our dedicated security contact. For the data processing agreement, further compliance documentation, and general inquiries, contact our team address. A responsible disclosure policy is in preparation.
Security reports & responsible disclosure
DPA requests, compliance evidence, general questions
Technical whitepaper
Full technical whitepaper with architecture details.
Privacy Policy
In preparation — intended to be publicly available.
Responsible Disclosure Policy
In preparation — intended to be publicly available.
DPA, TOMs, sub‑processor list
For business customers on request as part of the contractual documentation.
Pentest attestation, IR/BCP summary, C5 status
Planned — for enterprise customers under NDA in the future.