Data security
Table of contents
Content is available in multiple languages. Only the German version is legally binding.
Protecting your data is more than just a technical requirement for us—it is our top priority and a core part of our corporate philosophy. Our workplace management software combines verified standards, clear processes, and modern security measures to keep data secure and available at all times.
Security Management according to ISO 27001
Flexopus has been certified by TÜV Rheinland according to ISO 27001:2022. This certification ensures a standardized and maintained Information Security Management System (ISMS) both at Flexopus and at the data center of our hosting partner, Hetzner Online GmbH. This guarantees that technical and organizational security measures are systematically implemented and regularly audited.
Sovereign Cloud & Data Sovereignty – Made in Germany
We operate a sovereignty-oriented cloud architecture: data storage, processing, and key management take place entirely in Germany on ISO 27001-certified infrastructure.
- Our platform runs entirely on infrastructure located in Germany—without the use of hyperscalers like Amazon Web Services, Microsoft Azure, or Google Cloud Platform. Instead, we rely on dedicated systems from Hetzner Online GmbH for maximum control over data and systems.
- No storage or regular processing of personal data outside the EU.
- Strictly controlled and logged admin access.
- Key management takes place exclusively within our controlled infrastructure in Germany.
- Clear separation between infrastructure and data access—no third-party access.
Technical & Organizational Measures
Encrypted Data Transmission
Data is encrypted during transmission using the TLS protocol, the same standard used for online shopping and banking. The integrity of the encryption can be verified at SSL Labs.
Backups with Data-at-Rest Encryption
Flexopus is a cloud solution hosted on a dedicated server. Our customers' databases are backed up daily. Backups are stored for 30 days with data-at-rest encryption on a geographically independent server in Germany. After this period, the data is deleted.
Access Control & Logging
Flexopus enables role-based access, protects accounts with multi-factor authentication, and logs all activities centrally—ensuring every action remains traceable and secure.
Secure Working
Through regular training, clear security policies, and defined incident management processes, we ensure that security standards are maintained and that incidents are handled quickly and in a structured manner.
Infrastructure & Operations
- Our platform runs in a highly secure, ISO 27001-certified data center.
- Automated backups as well as patch and update management ensure stable and up-to-date systems.
- Critical components are monitored continuously to detect outages early.
- You can view the current operational status of our platform at any time at status.flexopus.com.
Product & Application Security
Our development team ensures that the application is developed release by release in compliance with internal security policies. Security measures are continuously refined to stay ahead of current threats. We consistently apply secure-by-design principles, making security an integral part of the software architecture from the very beginning.
- Internal manual audits:
Four-eyes principle during development, code reviews, functional testing, and security audits by our experts - Internal automated audits:
Code analysis, system logs, application logs, logging, and code quality checks - External audits / penetration tests:
Thanks to our customers, the software is audited by an independent third party at irregular intervals, but at least twice a year. Penetration tests are conducted by our customers as part of standard assessment and approval processes.
Cyber Resilience & DORA
Our platform is designed for resilience against disruptions and cyberattacks. Disaster recovery testing, third-party risk management, and business continuity measures ensure stable and secure services—fully in line with regulatory requirements such as DORA.
Data protection
Personal data is processed in compliance with the GDPR. You can find details about our data protection on our Privacy Policy page.
Contact for security questions
For feedback or inquiries regarding security, you can reach our team at: