KI-Denkraum

KI-Denkraum

Security and data protection

What IT, data protection and purchasing need to know, on one page. The linked legal texts are binding, above all the data processing agreement with its technical and organisational measures and the list of service providers.

Where your data is kept

We run no servers of our own. Database and sign-in run at Supabase in Amazon Web Services data centres in Frankfurt am Main, the application’s server functions at Vercel, also in Frankfurt am Main.

Not everything stays in the EU: Postmark sends our emails from the USA, the bot protection Turnstile runs on Cloudflare’s global network, and Supabase may access the database for operations and support from Singapore and the USA. The list of service providers names the safeguard for each service, for example the EU-US Data Privacy Framework or standard contractual clauses.

Before we add or replace a sub-processor, we inform the team’s owner by email at least 30 days in advance. You can object for a sound reason.

How we use AI

We develop the content from podcast conversations with the help of AI. The editors review and release it before it enters a room.

The platform does not pass account, team or billing data to any AI model, and we do not use personal data to train AI models.

For search, an AI model receives only the search term, through Amazon Bedrock in the EU and with no link to your account. AWS does not store it.

For support and operations, an AI model may help us in individual cases, only through Amazon Bedrock in the EU, in a separate working session and without storage at AWS. We delete its history when the session ends.

Sign-in and access

Everyone has their own account and signs in with a password, a sign-in link by email or Google. If your company has a pilot or seats on invoice, you can also sign in through your company account, by single sign-on (SAML 2.0), for example with Microsoft Entra ID, Google Workspace or Okta.

Row-level permissions in the database keep teams apart. Only a team’s owners and admins change members and invitations, and the server checks this on every action.

Testing and production use separate databases. Only the management has administrative access to the services, each with two-factor sign-in.

Encryption and backups

All connections are encrypted with TLS, and HSTS keeps browsers on HTTPS. Supabase and Vercel encrypt stored data with AES-256.

Supabase backs up the database daily and keeps the backups for seven days.

No analytics, no advertising

We use no analytics, advertising or tracking services, track no opens or clicks in emails and only set cookies that are technically necessary.

What you save and rate is visible to you alone. It is only ever summed up without reference to individuals.

Export, deletion and the end of a contract

Everyone can download their data and delete their account themselves at any time.

When a subscription or individual contract ends, we delete the team data within 30 days. If you ask for it in text form before the end, we first hand over the list of members and invitations.

Logs at the service providers expire automatically, after 45 days at the latest.

Certificates and evidence

As we run no servers of our own, the certificates of our service providers count: Supabase and Vercel to SOC 2 Type 2, Amazon Web Services for the Frankfurt region to ISO 27001 and BSI C5, among others.

We provide evidence on request, above all as documents, for example answers to your questionnaires. Where they do not suffice in an individual case, you can audit us on site. We review our measures at least once a year.

Report a vulnerability or incident

Found a vulnerability or noticed an incident? Write to hallo@kidenkraum.com. The management assesses every report.

If an incident affects data we process on your behalf, we notify the team’s owner without undue delay, within 48 hours where possible.

The management is the contact for data protection, at the same address. We have not appointed a data protection officer because there is no obligation to do so.

For automated tools, the address is also in the file security.txt.

Documents