Security & data protection

iAt a glance

1Hosting & AI processing

We run the application, database and backups at Hetzner Online GmbH in Germany; the off-site backup copies are stored on a Hetzner Storage Box in the EU. AI processing does not take place in the EU only: messages the AI is asked to answer are sent to providers in the USA. All recipients are listed in our list of subprocessors and in the privacy policy.

• Location: Nuremberg data center (Hetzner). Hetzner's data centers are certified to ISO/IEC 27001; Paldra itself does not hold a certification of its own yet.
• AI responses: Anthropic, PBC (Claude) – processing in the USA
• Second check: OpenAI (USA) checks responses independently and steps in when Anthropic is unavailable
• Fallback in the EU: Mistral AI (France), also used for knowledge search and text recognition
• Transfer basis: EU Standard Contractual Clauses (data processing addenda of Anthropic and OpenAI)
• Training: according to their business terms, Anthropic and OpenAI do not use data from API use to train their models
• Network: Cloudflare (DNS, proxy, DDoS protection) in front of our servers; the admin area is additionally reachable only through Cloudflare Access

2Data Encryption

All connections, the backups and particularly sensitive credentials are encrypted. We do not currently use disk encryption.

• In transit: TLS 1.2 or 1.3 for all external connections – website, dashboard, API, widget
• Backups: daily, AES-256 encrypted, in two locations: on the server (14 days) and on a Hetzner Storage Box in the EU (30 days)
• Integration credentials: stored encrypted (Fernet)
• Passwords and API keys: passwords with bcrypt and an individual salt, API keys only as a hash – never in plain text
• Disks: not encrypted; the database and uploaded files are protected by the access controls of the data center and the server

3Access Control

Who may see what is controlled in several places – and you can see our own access yourself.

• Two-factor sign-in: active for every account – code by email, optionally an authenticator app (TOTP) with backup codes
• Roles and permissions: owner, admin, agent and member, plus permissions per area
• Sessions: expire after 14 days at the latest; you can see signed-in devices in your account and sign them out one by one. Automatic sign-out after inactivity is not available yet.
• Customer separation: every query is bound to the workspace; automated tests check that knowledge and chats do not move between shops. Internal calls between our services are signed with HMAC.
• Support access: Paldra support can open your workspace settings to help you; the inbox, chats, analytics and customer data stay locked. Every opening and every saved change is logged and shown to owners and admins under Account › Security.

4GDPR & Compliance

We provide the contracts and processes required for operation: a data processing agreement, an open list of subprocessors, data export and deletion on request.

• Data Processing Agreement (DPA): View now
• Subprocessors: Transparent list of all recipients with location and purpose
• Redaction: email addresses, IBANs, card numbers, phone numbers and order numbers are removed from learning and evaluation data
• AI transparency (EU AI Act): the chat shows that an AI is answering and says honestly when a human takes over
• Data export: Full export of your data at any time
• Data deletion: Deletion on request within 30 days
• Privacy policy: Full policy

5Availability & Monitoring

Today Paldra runs on one application server and one database server. That is solid for our size, but it is not a high-availability setup – we would rather say so up front.

• Setup: two instances of the application on one server; we roll out updates one after the other, without downtime. Multiple servers sharing the load and a standby database do not exist yet.
• Monitoring: a watchdog checks the services every 2 minutes and sends an alert email when something fails. It runs on the same server; there is no permanent on-call duty.
• Availability: on the standard plans we do not commit to a specific availability (no SLA). The status page shows the current state.
• Recovery: backups run daily; in the worst case, changes from the last 24 hours are lost
• Updates: the server installs operating system security updates automatically
• Security incidents: a written procedure for incidents and data breaches; we inform affected customers in line with the GDPR and the DPA
• Audits: so far we carry out security reviews ourselves. An external penetration test and certifications such as ISO 27001 or SOC 2 are still outstanding.

6Responsible Disclosure

Found a security vulnerability? We take security seriously and ask you to report it to us responsibly.