Security and trust
Hosting in Germany, encryption, backups and restore drills, plus every service that processes customer data and how to reach us about security.
- Hosted in Germany
- Encrypted in transit and at rest
- Restores tested at least monthly
Where your data is stored
The service runs exclusively in data centres in Germany, in Nuremberg and Falkenstein, operated by Hetzner Online GmbH, Gunzenhausen. Everything stored in the service stays there: bills of materials, findings, cases, report texts and the audit log. Data is encrypted in transit; at rest, the database volume is encrypted with our own key, and backups are encrypted before they leave the server.
How we build and run the service
- Every change passes automated tests, static analysis and a dependency vulnerability scan before it is deployed, and production runs exactly the image CI built, pinned by its digest.
- Administrative access only through personal accounts with multi-factor authentication: no shared accounts, least privilege, and access rights reviewed at least quarterly.
- Production, test and development environments are separate, and no customer data is used outside production.
- Checked against every OWASP ASVS 4.0.3 Level 1 requirement before production held customer data: each one answered with evidence, a test or the written reason for a deviation.
- External monitoring outside our own infrastructure, a documented incident procedure, and runbooks with tested restore procedures.
Technical and organisational measures
Identical in substance to Annex 2 of the data processing agreement.
Confidentiality
- Data centres in Germany with access control and ISO/IEC 27001 certification; we operate no server rooms of our own.
- Administrative access only through personal accounts with multi-factor authentication, no shared accounts, least privilege.
- Strict separation of customers: every record is tagged with its account, and the database enforces this separation with row-level security, in addition to the application.
- Passwordless sign-in through one-time links; API tokens are stored only as cryptographic hashes and can be restricted and revoked.
- Production, test and development environments are separate, and no customer data is used outside production.
Integrity
- All connections encrypted with TLS 1.2 or higher.
- Alert e-mails carry only what they need and link to the service.
- An append-only audit log of every relevant action, per account, with time and user.
- Every change passes automated tests, static analysis and a dependency vulnerability scan before it is deployed, and production runs exactly the image CI built, pinned by its digest.
Availability
- PostgreSQL database with continuous archiving and point-in-time recovery; backups are encrypted before they leave the server and are stored in object storage in Germany with write-once locking; restore procedures are tested at least monthly.
- Encryption of stored data at rest: the storage volume holding the database, application data and logs is encrypted; the server's system disk holds no personal data; backups are encrypted.
- External monitoring outside our own infrastructure, which alerts us when the service, a data source or alert delivery fails, and a documented incident procedure.
Review
- Access rights are reviewed at least quarterly, and these measures at least annually and after significant changes.
- Automated checks for updates to the software components we use: weekly for Go modules, container images and infrastructure code, monthly for GitHub Actions and npm packages.
- Data protection by default: only what the service needs, no tracking, no advertising, and no use of customer data for anything else, in particular not for training AI models.
Data protection
No analytics, no tracking, no cookies, and nothing loaded from another company’s servers: fonts, stylesheets and images all come from this domain. That is why you were not asked about cookies.
Data protection by default: only what the service needs, no tracking, no advertising, and no use of customer data for anything else, in particular not for training AI models.
Who else processes your data
These three, and nobody else. The table reproduces Annex 3 of the data processing agreement word for word.
Sub-processor: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany
- Service
- Cloud hosting: servers, storage volumes, object storage for backups
- Location of processing
- Germany (data centres in Nuremberg and Falkenstein)
- Third-country safeguards
- Not applicable (no third-country processing)
Sub-processor: STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany
- Service
- Hosting of the support mailbox (e-mails to the support address)
- Location of processing
- Germany
- Third-country safeguards
- Not applicable (no third-country processing)
Sub-processor: Scaleway SAS, 8 rue de la Ville l'Evêque, 75008 Paris, France
- Service
- Delivery of transactional e-mails (login links, notifications)
- Location of processing
- European Union (data centres in the Paris region, France)
- Third-country safeguards
- Not applicable (no third-country processing)
Sign-in links and alerts are delivered by Scaleway SAS, Paris, which processes them in the European Union. Our e-mails contain no tracking pixels and no tracked links. E-mails to our support address are processed in a mailbox hosted in Germany by STRATO GmbH, Berlin.
Reporting a vulnerability to us
Write to contact@bithive-it.com, the address listed in our security.txt. We will not take legal action against good-faith research, and we will let you know when the issue is fixed.
https://bithive-it.com/.well-known/security.txt
Uptime and status
During an incident we inform the Owner and Administrators of affected accounts by e-mail and post updates on the status page, which is hosted separately from the Reporting Desk.
External monitoring outside our own infrastructure, which alerts us when the service, a data source or alert delivery fails, and a documented incident procedure.
The agreed availability, and how it is measured, is set out in the service level agreement.
The documents themselves
Terms, data processing agreement, privacy notice and service level agreement, each version at its own address.
The documents themselves