Security

Our application servers (Vercel, region Frankfurt fra1) and database / file storage (Supabase, region EU Frankfurt) run in Germany. Some optional features use specialised providers that process data partly outside the EU (for example US providers for speech transcription, email delivery and monitoring). These transfers rely on EU Standard Contractual Clauses and, where certified, the EU–US Data Privacy Framework. A complete list is available in the Privacy Policy.

• TLS 1.2+ for every connection — no unencrypted traffic.
• HSTS enabled on all domains.
• At-rest encryption: Postgres database and file storage are server-side encrypted with AES-256.
• Passwords are stored only as hashes (bcrypt/argon2) — we cannot read them.

• Strict per-organisation isolation at the database level via Postgres Row-Level Security.
• Role-based access control with five tiers — Finanzierer, Untervertrieb, Berater, Vertriebsleitung, Admin.
• Bot protection on login and sensitive endpoints via Vercel BotID.
• All administrative actions are recorded in an audit log.

The production database is backed up daily. Backup retention: 7 days rolling. We perform recovery tests regularly.

• All changes go through code review and automated lint, typecheck and test pipelines.
• Dependencies are kept up to date via Dependabot / Renovate.
• Secrets live only in Vercel environment variables — never in the repository.
• Error and performance monitoring via PostHog.

Security incidents involving personal data are reported to the competent supervisory authority within 72 hours pursuant to Art. 33 GDPR and — where required — directly to affected customers.

Responsible disclosure reports are welcome at security@deal-pipe.de. We typically respond within two business days.

Business customers processing personal data of third parties in DealPipe can sign a DPA including EU Standard Contractual Clauses (SCCs) under Art. 28 GDPR. Request at privacy@deal-pipe.de.

A current list of sub-processors (hosting, database, email, monitoring, AI, analytics) is available in sections 4 and 5 of the Privacy Policy.