Security

DealPipe runs entirely in the European Union. Application servers (Vercel, region Frankfurt fra1) and database / file storage (Supabase, region EU Frankfurt) are located in Germany.

• TLS 1.2+ for every connection — no unencrypted traffic.
• HSTS enabled on all domains.
• At-rest encryption: Postgres database and file storage are server-side encrypted with AES-256.
• Passwords are stored only as hashes (bcrypt/argon2) — we cannot read them.

• Strict per-organisation isolation at the database level via Postgres Row-Level Security.
• Role-based access control with five tiers — Finanzierer, Untervertrieb, Berater, Vertriebsleitung, Admin.
• Bot protection on login and sensitive endpoints via Vercel BotID.
• All administrative actions are recorded in an audit log.

The production database is backed up daily. Backup retention: 7 days rolling. We perform recovery tests regularly.

• All changes go through code review and automated lint, typecheck and test pipelines.
• Dependencies are kept up to date via Dependabot / Renovate.
• Secrets live only in Vercel environment variables — never in the repository.
• Error and performance monitoring via Sentry.

Security incidents involving personal data are reported to the competent supervisory authority within 72 hours pursuant to Art. 33 GDPR and — where required — directly to affected customers.

Responsible disclosure reports are welcome at kontakt@deal-pipe.de. We typically respond within two business days.

Business customers processing personal data of third parties in DealPipe can sign a DPA including EU Standard Contractual Clauses (SCCs) under Art. 28 GDPR. Request at kontakt@deal-pipe.de.

A current list of sub-processors (hosting, database, email, monitoring, AI, analytics) is available in sections 4 to 6 of the Privacy Policy.