AI assistant
Automated replies
You're writing with an AI assistant, not with Kevin. The replies are generated automatically. Kevin doesn't read along here. Reach Kevin directly
As soon as I build something for you (chatbot, enquiry automation, website), data is created. Here's where it lives, and here's how it's protected. No marketing talk.
Sensitive fields are masked with AES-GCM encrypted. Transport routes are protected via TLS; keys and access rights are managed separately from the application login.
Hetzner's German data centers are certified to ISO/IEC 27001; for the cloud services, a BSI C5 Type 2 attestation is in place. Hetzner has these attestations checked regularly in the respective audit procedures.
Encryption is only one building block. Roles, two-factor sign-in, device binding, logging and separate backups limit risks even when a single protection fails.
Sounds big — and it is. But: security is not a marketing term, but an obligation. In what follows, I show you specific, where your data is stored, who has access to it, and what happens if something does go wrong.
Server location Nürnberg · Data processing exclusively within the EU · Data processing agreement pursuant to Art. 28 GDPR concluded
I host the core systems on my own instances at Hetzner Online. The German data centres are ISO/IEC 27001 certified; the cloud services hold a BSI C5 Type 2 attestation. Which specialised services are additionally integrated is documented in the privacy policy.
The core systems — website, cockpit and database — run on German Hetzner data centres. Features such as AI, voice, consent management or reach measurement may involve specialised processors and, depending on the service, trigger third-country transfers. Provider, purpose and legal basis are listed in the Privacy policy.
Hetzner's German data centres are certified to ISO/IEC 27001, and a BSI C5 Type 2 attestation is available for the cloud services. The evidence is regularly checked in the respective audit process.
High-security fencing with anti-climb and anti-dig protection, comprehensive video surveillance, documented access media, separate lockable racks. 24/7 on-site staff.
Redundant power supply with UPS and emergency generators, redundant network connection, fire early detection connected to a monitoring centre, permanently active DDoS detection. Daily backups run automatically.
Hetzner has a designated data protection officer (email and phone on file). In the event of a data protection breach, I'm informed immediately — and then you. Cleanly documented, verifiably provable.
When our collaboration ends: data is deleted in line with data protection rules, or the storage media are physically destroyed. No "who-knows-where-that-still-lies-around". On request, you get a confirmation.
Hetzner provides the data centre, the hardware, the power, the fence. But what runs on the servers running — in other words, the software that processes your data — that's my area. So you know what depends on what:
As soon as I process personal data on your behalf (customer enquiries, addresses, phone numbers or data that your chatbot or workflow handles), you are the "controller" under GDPR — and I am the "processor". So before this processing begins, we conclude a Data processing agreement (DPA) under Art. 28 GDPR — free of charge, in text form and with the sub-processors actually used in each case.
In these cases, the data processing agreement (AVV) is a binding part of project preparation and will be provided before processing is activated.