Technical and Organizational Measures (TOM)
Annex 1 to DPA — Version 1.0 — As of: March 12, 2026 | Deutsche Version
The following technical and organizational measures are implemented by VIAVENDO.AI (“Processor”) to ensure a level of security appropriate to the risk in accordance with Art. 32 GDPR.
1. Confidentiality (Art. 32(1)(b) GDPR)
1.1 Physical Access Control
Measures to prevent unauthorized persons from gaining physical access to data processing systems:
- All servers are hosted in Hetzner Cloud data centers in Germany (Falkenstein and Nuremberg locations)
- Hetzner data centers are ISO 27001 certified and feature 24/7 security personnel, video surveillance, electronic access control systems, and multi-zone security perimeters
- No proprietary physical infrastructure — all physical access control is managed by the data center operator
1.2 System Access Control
Measures to prevent unauthorized use of data processing systems:
- SSH key-based authentication exclusively (password authentication disabled)
- Fail2ban intrusion detection and automatic IP blocking
- Host-based firewall (UFW/iptables) with restrictive inbound rules
- Centralized authentication via Authentik SSO (auth.viavendo.com)
- TLS 1.2+ encryption for all administrative and user-facing connections
- Regular security updates and patch management
- No default credentials — individual access credentials per administrator
1.3 Data Access Control
Measures to ensure that authorized users can only access data within their authorization scope:
- Role-based access control (RBAC) with granular permission levels per tenant
- Tenant isolation through dedicated Docker containers and separate databases per customer instance
- Principle of least privilege for all system and application access
- API key scoping with per-endpoint permissions
- Admin, manager, and user role separation within each tenant
1.4 Separation Control
Measures to ensure that data collected for different purposes is processed separately:
- Dedicated Docker containers per customer instance (complete process isolation)
- Separate databases per customer (no shared database tables)
- Separate Qdrant vector indices per customer for RAG knowledge base isolation
- Logical separation of development, testing, and production environments
- Network segmentation between customer instances
1.5 Pseudonymization and Encryption
Measures for pseudonymization and encryption of personal data:
- TLS 1.2+ encryption for all data in transit (client-to-server and server-to-server)
- Bcrypt hashing for user passwords (no plaintext storage)
- Hashed API keys (only hash stored, original key shown once at creation)
- Privacy by default — minimal data collection principle
- Internal identifiers (UUIDs) used instead of personal data where technically feasible
2. Integrity (Art. 32(1)(b) GDPR)
2.1 Transfer Control
Measures to ensure that personal data cannot be read, copied, modified, or removed without authorization during electronic transfer:
- TLS encryption for all client-to-server communication
- Encrypted backend communication between application components
- HTTPS connections exclusively for communication with LLM providers (OpenAI, Anthropic, Google)
- Comprehensive audit logging of all data access and transfer operations
- API authentication required for all data endpoints
2.2 Input Control
Measures to ensure that it is possible to verify and establish whether and by whom personal data has been input, modified, or removed:
- Audit logging in accordance with EU AI Act requirements for all AI interactions
- Logging of all AI interaction metadata (model, timestamp, user, token usage)
- Administrative change logging (configuration changes, user management)
- Immutable log entries with timestamps and user attribution
- Log retention in accordance with statutory requirements
3. Availability and Resilience (Art. 32(1)(b),(c) GDPR)
3.1 Availability
Measures to ensure that personal data is protected against accidental destruction or loss:
- Redundant data center infrastructure (Hetzner Cloud Germany)
- Continuous monitoring via Process Observer and Cloud Host Observer
- Automated backup schedules with verified restore procedures
- DDoS protection at infrastructure level
- 99.5% availability SLA target (annual average)
- Automated alerting for service degradation and outages
3.2 Disaster Recovery
Measures to ensure rapid restoration of availability and access to personal data in the event of a physical or technical incident:
- Emergency response plan with defined escalation procedures
- Automated daily backups with off-site retention
- Systemd service management and Docker restart policies for automatic recovery
- Documented recovery procedures with defined recovery time objectives (RTO)
- Regular backup restoration testing
4. Regular Review Procedures (Art. 32(1)(d), Art. 25(1) GDPR)
Procedures for regular review, assessment, and evaluation of the effectiveness of technical and organizational measures:
- Periodic review of security configurations and access controls
- Monitoring and evaluation of security incidents and near-misses
- Regular assessment of TOM adequacy in light of evolving threats
- Integration of data protection by design and by default principles into the development process (Art. 25 GDPR)
- Evaluation of new technologies and security measures for adoption
5. Data Protection Organization
- Designated data protection responsibilities within the organization
- Employee training on data protection and information security
- Confidentiality commitments for all persons processing personal data
- Documented processes for data subject requests and data breach response
- Records of processing activities maintained in accordance with Art. 30 GDPR
6. Commissioned Processing Control
Measures to ensure that personal data processed on behalf of the Controller can only be processed in accordance with the Controller’s instructions:
- Careful selection of sub-processors based on data protection and security criteria
- Data processing agreements (Art. 28 GDPR) concluded with all sub-processors
- Regular review of sub-processor compliance
- Current list of sub-processors available at /en/subprocessors