Hosted in Germany
Audienca Reflection runs on servers of Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) in the Falkenstein/Vogtland data centre, Germany. This applies to the application and to the databases alike. A data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner.
Certifications
The data centres of our hosting partner Hetzner Online GmbH are certified to ISO/IEC 27001.
sense.AI.tion GmbH itself is not certified to ISO/IEC 27001. Instead, we evidence our security measures individually, through the technical and organisational measures annexed to our data processing agreement. If you need them for your own review, we provide them on request as a completed sheet.
Encryption
- Transport: All external access and all transfers to sub-processors use TLS (HTTPS). Connections to the databases are TLS-encrypted as well.
- Access keys: We store the access keys of the MCP server as hashes only.
Availability and Backups
The service runs on several server nodes within one data centre; failed services are restarted automatically. We currently give no assurance regarding backups, retention periods, recovery times or restore tests. Our data processing agreement says the same.
Access Control
- Sign-in via Firebase Authentication
- Access control per account and project; there is no role model for individual persons
- Interface access (MCP) with separate read and write permissions
- Logging of operations and changes with timestamp and acting account; for every inquiry it is traceable who released a reply and whether the text was edited beforehand
AI Models and Data Handling
For AI-based response generation, we use the OpenAI API (OpenAI OpCo, LLC, USA). Data transfer to the USA is based on the EU Standard Contractual Clauses and a Data Processing Addendum. Under OpenAI’s API terms, the submitted data is not used to train the underlying models. We use the standard endpoint without an EU endpoint and without Zero Data Retention: OpenAI may retain the content for up to 30 days for abuse monitoring and may also process it outside the EU.
Security Checks
Code changes to the Audienca service go through automated checks: static code analysis, scanning of dependencies and container images for known vulnerabilities, and a search for accidentally committed credentials. We do not claim a penetration test or an external security audit.
Vulnerability Disclosure
Security issues can be reported confidentially to info@senseaition.com. We follow coordinated disclosure.
Data Protection
Processing is governed by our Data Processing Agreement and privacy policy. DPA at /en/orderprocessing, privacy policy at /en/privacy.
Security Questions?
For security or audit requests, contact info@senseaition.com.