Data security – technical and organisational measures

1. Overview

2. Hosting and data location

Business data for EU-based customers is processed and stored at Hetzner in Germany. Nightly database and file backups include copies on a separate Hetzner Storage Box in Germany and a secondary copy at Scaleway Object Storage in Paris. Copies held on the server are retained for 14 days; the documented arrangement keeps Storage Box and Scaleway copies without a defined expiry. The Scaleway copy is encrypted at the storage provider. Website and platform are hosted separately: necesso.ai uses Netlify for the marketing site, and GoDaddy for domain management. Website and infrastructure logs have their own retention periods.

3. Encryption

Browser-to-service connections use HTTPS/TLS. The technical documentation describes AES-256 (pgcrypto) encryption for supplier credentials, authenticator secrets, bank sessions, WhatsApp tokens and known values used by the privacy gateway. Encryption keys are stored outside the database, separated by purpose, rotated periodically, and existing values are re-encrypted after rotation.

Newly documented: Necesso encrypts each nightly database and file backup itself using AES-256 before it leaves the server, with the backup key held separately. This does not mean that every primary server disk is encrypted: operator-managed full-disk encryption is not documented. Individual connections inside the same server's private container network do not all use separate TLS.

4. Tenant separation and backups

Database row-level security separates businesses; roles and function-specific permissions also restrict data visibility within each business, with server-side checks and automated tests.

Backups: Database and uploaded files are backed up nightly. Copies are kept for 14 days on the server and, according to the supplied documents, without a fixed expiry on Hetzner Storage Box (Germany) and Scaleway Object Storage (Paris). Necesso encrypts backup copies with AES-256 before transfer. The Scaleway copy is protected against modification and deletion for ten years in governance mode. Restoration tests and a deletion log are documented. Important: personal data erased from the live system can remain in historic immutable backups; deletions are re-applied after restore. A finite retention policy for every backup tier is still required.

5. Access control

The service uses individual accounts, Argon2id password hashes, scoped access rights, passkeys and alternative two-factor methods. A passkey private key stays on the device; Necesso retains the public key, credential identifier, browser/system details and last-use timestamp. Passwords set through invitation or reset links are checked against breached-password datasets via a hash prefix sent to “Have I Been Pwned”; if that service is unavailable, the password is accepted under the documented behaviour.

Privileged operators with server access can technically read the database. This access is not necessarily visible in the customer business's activity log; the service should not be described as technically inaccessible to all operators.

6. AI features and pseudonymisation

The in-app assistant is currently configured server-side to use Mistral AI's EU endpoint. Other documented Mistral functions include receipt reading, catalogue search and speech input. If the assistant were configured for Anthropic, its requests would have to pass the same privacy gateway as other Anthropic tasks. Each AI step should receive only the fields necessary for its task.

For requests from EU-based businesses to Anthropic (USA), the gateway checks known identifiers in the records the requesting person may access, fixed patterns, and free-text names/addresses marked by Mistral. Detected values are replaced by per-request placeholders. Their value-to-placeholder mapping is held only in the EU server's memory while the request is running; known business-record values are held encrypted in the EU database. Restoring values is limited to records the requester is still authorised to see.

Fail-closed and audit: If a check fails or is identified as incomplete, the request is not sent to Anthropic and instead awaits a person's review. A send intent is recorded before transmission and the outcome afterward; absent outcome entries are treated as unknown. Limit: Unrecognised nicknames, unusual spellings and indirectly identifying descriptions may still pass through. Pseudonymisation is not anonymisation, and an appropriate transfer mechanism under Articles 44 et seq. GDPR must still be verified.

WhatsApp text and the documented derived records tagged as originating from speech are not routed to Anthropic for EU businesses; manually copied text and older records may not retain the origin tag.

7. Call recording and transcription

Once telephony is enabled, the current technical documentation describes an announcement at the beginning of the call followed by recording. The recording is retrieved and deleted from the telephony provider, then transcribed on Necesso's own servers with faster-whisper. Active call audio is deleted 14 days <em>after its transcript exists</em>; WhatsApp voice messages and job audio after seven days. A missing transcript can prevent the automatic deadline from starting. Historical internal backups are separate. A spoken announcement is not proof of any legally required consent: the lawful basis and recording workflow must be reviewed before activation.

8. Data transfers outside the EEA

Four safeguards apply to pseudonymised customer data sent to Anthropic outside the EEA:

1. encrypted in transit, with separately protected selected secrets and provider-side encrypted offsite backups,
2. direct identifiers removed or replaced by placeholders beforehand,
3. the mapping key remains in the EEA,
4. legal basis under Art. 44 et seq. GDPR (adequacy decision or EU Standard Contractual Clauses).

Otherwise no transfer to Anthropic takes place. Dictation audio in DE/EN/HU/TR is sent to Mistral’s EU API endpoint without a transfer outside the EEA. Once Twilio is activated, phone numbers, call times and SMS content may also be processed in the USA under its DPA and EU Standard Contractual Clauses. See privacy-policy section 10 for WhatsApp.

9. Retention periods and deletion

Business records are generally held for the contract term and, where applicable, statutory retention periods. Many Austrian accounting records require seven years. Call audio is deleted 14 days after transcription; WhatsApp and job audio seven days after transcription. If no transcript exists, the documents do not define an automatic deletion clock. Support chats remain until deleted, product search analytics for twelve months, and platform server logs for 30 days.

Backups remain for 14 days on the server and are documented as currently having no fixed expiry on Hetzner Storage Box and Scaleway. Erasures are re-applied after restoration. Unlimited historical backup retention remains an unresolved GDPR storage-limitation issue. See the privacy policy.

10. Logging and monitoring

Authentication and security events, permission changes and business operations are logged according to the technical annex. The privacy gateway logs the intended transmission before sending an Anthropic request and then its result (sent, EU-processed, refused or provider error), without the detected personal values. Missing outcome entries are marked unknown; businesses can review and export monthly evidence. The retention period for this evidence remains undetermined.

Under the final documentation, platform server logs contain no passwords, content, names, email addresses or telephone numbers and are deleted after 30 days. This does not cover Netlify website logs. Product search analytics are retained for twelve months after filtering recognised identifiers; recently entered or unusual identifiers may still be missed. Privileged direct database access outside the customer-facing application is not comprehensively reflected in customer activity logs.

11. Personal data breaches

• The Contractor informs affected client businesses without undue delay after becoming aware of a breach of their data.
• It supports them in notifying the data protection authority within 72 hours (Art. 33 GDPR) and in informing data subjects.

12. Sub-processors

The Contractor informs client businesses in advance of any changes to its sub-processors.

Additional payment providers used only after activation: Stripe Payments Europe Ltd. (Ireland) and Adyen N.V. (Netherlands) for hosted checkout pages. According to the supplied documentation, Necesso stores transaction statuses, amounts, fees and payouts, not payment-card details.

13. Organisational measures

The supplied annex documents permission checks, automated security tests, integrity verification, monitoring, dependency scans and restoration tests. It also describes an incident-response plan that has not yet been exercised. A comprehensive written security policy and risk register, an independent documented penetration test and an independent certification remain unverified. No 24/7 on-call commitment, separate standby server or guaranteed recovery time has been documented.

14. Scope and limitations of this statement

Underlying technical description dated 29 October 2026. This page describes the published technical and organisational measures. It is not an independent penetration-test attestation or security certification. The documented historic offsite backups do not have a fixed deletion deadline; no guaranteed recovery time or 24/7 on-call service is promised. Information about the applicable contractual data-protection safeguards and customer-specific DPA is available at office@necesso.ai.