Your Data.
Your Security.
Our Promise.

Security is not a feature – it's the foundation of Structurepal. We treat your company data with the highest care and transparency.

GDPR Compliant
German Servers
End-to-End Encrypted

What Does Security Mean at Structurepal?

Security is more than just a locked door. It's about trust, transparency, and control.

GDPR Compliance

Full compliance with the EU General Data Protection Regulation. Including data processing agreement (DPA) and documented data protection impact assessment.

  • DPA by default
  • Data deletion on request
  • Documentation export (PDF)

German Server Locations

All data is stored exclusively on ISO-certified servers in Germany. No cloud hopping, no US server access.

  • Frankfurt data center
  • ISO 27001 certified
  • No third-country transfer

End-to-End Encryption

Your data is encrypted both in transit (TLS 1.3) and at rest (AES-256). Only you have access.

  • TLS 1.3 standard
  • AES-256 encryption
  • Secure key management

Granular Access Control

You determine who can see what. Role-based permissions ensure that sensitive data can only be viewed by authorized persons.

  • Roles & permissions
  • Two-factor authentication
  • Session management

Automatic Backups

Your data is backed up daily and can be restored in an emergency. Redundant storage at multiple locations guarantees highest availability.

  • Daily backups
  • 30-day retention
  • Geo-redundancy

99.9% Uptime Guarantee

Structurepal is available 24/7. Load balancing and auto-scaling ensure that you always have access to your processes, even under high load.

  • 24/7 monitoring
  • Auto-scaling
  • Status page available

Certifications & Compliance

We undergo regular external audits and penetration tests.

ISO 27001

Information Security Management

GDPR

EU General Data Protection Regulation

Penetration Testing

Quarterly external tests

Security Audits

Annual security reviews

Data Processing & Storage

Where is your data stored?
All data is stored exclusively in ISO-certified data centers in Frankfurt am Main. No transfer to third countries outside the EU.

How long is data stored?
During active use, all process data is continuously stored. After contract termination you have 30 days to export your process documentation as PDF before it's irrevocably deleted.

Who has access to my data?
Only you and the leaders and process owners you've authorized. Our support team only has temporary access with your explicit permission (e.g., for technical issues).

Technical Security Measures

Encryption
  • • TLS 1.3 for all data transfers
  • • AES-256 for data at rest
  • • Encrypted backups
  • • Secure key management (HSM)
Authentication
  • • Two-factor authentication (2FA)
  • • Single Sign-On (SSO) possible
  • • Password complexity requirements
  • • Automatic session timeouts
Monitoring & Logging
  • • 24/7 security monitoring
  • • Intrusion detection systems
  • • Audit logs for all access
  • • Automatic anomaly detection
Backup & Recovery
  • • Daily automatic backups
  • • Geo-redundant storage
  • • 30-day backup retention
  • • Tested disaster recovery plan

GDPR Compliance in Detail

Your Rights as a User
  • Right to Access: View your stored data anytime
  • Right to Portability: Export all data in machine-readable format
  • Right to Erasure: Complete data deletion on request
  • Right to Rectification: Correction of incorrect data anytime
Our Obligations
  • DPA Included: Data processing agreement by default
  • Data Protection Impact Assessment: Documented and available
  • Notification Duty: Breach notification within 72h
  • Transparency: Clear privacy policy without fine print

Incident Response & Support

What happens in case of a security incident?

  1. Immediate Containment: Affected systems are isolated
  2. Analysis & Assessment: Our security team evaluates the incident
  3. Customer Information: You'll be informed within 24 hours
  4. Resolution: Vulnerabilities are closed and tested
  5. Post-Mortem Analysis: Transparent report on causes and measures
Transparency Promise: For every security incident we inform you proactively – even if your data isn't affected.

Frequently Asked Security Questions

Currently we offer Structurepal as a SaaS solution in German data centers. For companies with 1,000+ employees or special compliance requirements we can offer individual on-premises or private cloud solutions. Contact us!

Security-critical updates are deployed immediately. Regular updates occur weekly outside business hours. You'll be informed about planned maintenance at least 48 hours in advance.

For enterprise customers we offer BYOK (Bring Your Own Key), so you maintain complete control over your encryption keys. Contact our sales team for more information.

You can export your process documentation as PDF anytime. The documentation contains all your process cards, team overviews, and relevant information in a clear format. The export is immediately available for download.

Only you and the leaders and process owners you've authorized have access to your data. Our support team can only access your data with your explicit consent and for a limited time period – e.g., for troubleshooting. All access is logged.

Have More Security Questions?

Our security team is happy to answer all your data protection and security questions.

Book Security Consultation Contact Security Team