Trust is earned through control — not promises.

A named information security officer is responsible for building, running and developing our ISMS. A security committee made up of management, IT operations and our data protection officer meets regularly to review measures, risks and incidents.

Information security risks are captured, assessed and treated through a structured, repeatable process. The risk register is reviewed at least annually and whenever circumstances warrant; management decides on the treatment of any residual risk.

Permissions follow the principle of least privilege and need-to-know. Two-factor authentication is mandatory for remote access, privileged accounts and access to case and file data; granted permissions are reviewed regularly and revoked where no longer needed.

Systems and components in use are regularly checked for vulnerabilities; security-relevant updates are applied on a risk-based, time-bound basis. Vendor advisories and relevant security notices are monitored continuously.

A documented reporting process exists for security incidents, involving our external data protection officer — providing the guidance needed to meet data protection notification duties on time.

Production data is backed up daily and stored in geographically separated locations. Recoverability is actually tested on a regular basis, not merely assumed — part of a documented business continuity and recovery plan.

All employees are bound to confidentiality and complete recurring information security and data protection training with a pass/fail check. Suppliers undergo a security and privacy review before being engaged and are bound contractually.

Gifts, invitations and conflicts of interest above clearly defined minor thresholds are disclosed rather than concealed; stricter standards apply toward public officials. Business decisions are made solely on objective criteria.

A dedicated reporting mailbox with an anonymous online option is available for breaches of our anti-corruption and code-of-conduct policy, as well as for discrimination, harassment or bullying. Reports are investigated confidentially; retaliation against whistleblowers is prohibited.

We voluntarily align our due-diligence practices with the German Supply Chain Due Diligence Act (LkSG), even below the statutory threshold that would otherwise apply. This rests on internationally recognized human rights, the ILO core labor standards and the UN Guiding Principles on Business and Human Rights. No violations have been identified in the past five years.

New suppliers, business partners and clients are screened against the consolidated EU and UN sanctions lists before any contract is signed — including infrastructure and cloud providers. Critical business relationships are re-screened regularly, since sanctions lists change.

As a pure software and services company with no manufacturing of our own, we keep our environmental footprint low. We expect comparable standards on human rights, working conditions and environmental protection from our suppliers and business partners.