Security & data protection

iAt a glance

1Infrastructure & Hosting

All Alpheris services run on servers in Germany (Hetzner Online GmbH). Hosting, database and backups are located within the EU. Individual processing steps are carried out by recipients based in the USA; these are listed in our list of subprocessors and in the privacy policy.

• Location: Data centers in Germany (Nuremberg / Falkenstein)
• Certifications: ISO 27001, SOC-audited data centers
• Network: DDoS protection and Web Application Firewall via Cloudflare
• Backups: Daily encrypted backups with geographic redundancy within the EU

2Data Encryption

Data is encrypted both in transit and at rest.

• In transit: TLS 1.3 for all connections – APIs, dashboard, widget
• At rest: AES-256 encryption for databases and file storage
• API keys: Hashed and stored securely, never in plain text
• Passwords: Bcrypt hashing with individual salts

3Access Control

We rely on multiple layers of access control to protect your data.

• Two-factor authentication (2FA): TOTP-based, available for all accounts
• Role-based access control: Fine-grained permissions for team members
• Session management: Secure, time-limited sessions with automatic logout
• Internal access: Principle of least privilege – staff only have access to what they need for their work

4GDPR & Compliance

We provide the contracts and processes required for operation: a data processing agreement, an open list of subprocessors, data export and deletion on request.

• Data Processing Agreement (DPA): View now
• Subprocessors: Transparent list of all subprocessors
• Data export: Full export of your data at any time
• Data deletion: Deletion on request within 30 days
• Privacy policy: Full policy

5Availability & Monitoring

We monitor our systems around the clock to ensure maximum availability.

• Uptime target: 99.9% availability
• Monitoring: 24/7 monitoring of all critical systems
• Incident response: Defined processes for security incidents
• Automatic scaling: Load balancing for consistent performance

6Responsible Disclosure

Found a security vulnerability? We take security seriously and ask you to report it to us responsibly.