How we actually protect your data
No "military-grade" claims, just the concrete measures in place, and why each one exists.
1. Data Sovereignty
All servers are physically located in Germany, subject to German and EU law. No routine transfer of your data to third countries.
2. Encryption in Transit
All connections use TLS 1.3. Unencrypted connections are not accepted by our servers.
3. Encrypted Storage
Data at rest is encrypted (AES-256 / gocryptfs, depending on the service). A physical server theft alone cannot expose readable data.
4. Backups & Replication
Automatic encrypted backups run nightly, with retention periods defined per service. Critical services run on a primary server with a hot-standby replica.
5. Monitoring & Alerts
Uptime, certificate expiry, disk space, and failed login attempts are monitored continuously. Alerts route to a real person, not a dashboard nobody watches.
6. Access Control
Access is role-based and logged. Passwords are stored as cryptographic hashes, never in plain text. Shared credentials are avoided wherever a system supports individual accounts.
7. Incident Response
If something breaks or looks wrong, you reach the person who runs the system directly, not a support queue. Confirmed security incidents affecting your data are disclosed to you without delay.
8. Maintenance Policy
Security patches and updates follow a regular schedule rather than waiting for something to go wrong. Certificates renew automatically and are checked, not assumed.
Security isn't optional for organisations like yours
NGOs and civil society organisations carry a kind of risk most businesses don't: donor trust, beneficiary safety, and sometimes personal safety depend on how well data is protected.
Donor & Beneficiary Trust
A single data leak involving beneficiary or donor records can undo years of relationship-building.
Legal & Compliance Exposure
GDPR breach notification duties and funder due-diligence requirements assume real data stewardship, not just good intentions.
Targeted Threats
Human rights organisations, journalists, and advocacy groups face targeted phishing and, in some contexts, state-level surveillance.
Operational Continuity
An outage without proper backups can halt field operations for weeks, at the exact moment your mission needs you most.
Questions about a specific requirement?
Compliance audits, staff security training, or a specific threat model, tell us what you're working with.
Make Contact