Your data. Our responsibility.
Robust safeguards and proven processes to protect your data and ensure business continuity.
ISO 27001 certified
amber operates a documented ISMS that is audited according to the ISO 27001 standard. Furthermore, amber is developed in accordance with the SOC-2 standard. TOMs are documented in our DPA documents.
Built to protect. Designed to recover.
We combine strong technical measures with clear processes to keep your data secure and your business resilient.
Deletion on request
Sensitive data can be deleted on request and fully removed from all amber servers. Deletion metadata is logged.
Backup & disaster recovery
Full backups are created by default for disaster recovery, using documented DR capabilities of the hosting environment.
Incident handling
Incidents are handled through a structured, severity-based process. Breach reporting follows GDPR Art. 33/34. The DPO is involved in relevant cases.
Third parties & subprocessors
Third-party components are reviewed before use. Subprocessors are contractually bound to equivalent data protection obligations.
How we protect your data
A defense-in-depth approach combining certified standards, strict access controls, isolated infrastructure, continuous patching, full audit logging, and privacy-by-design principles.
Certified information security
- ISO 27001 certified
- Continuously maintained ISMS
- TOMs documented in AVV/DPA materials
Access control & authentication
- Role-based permissions, least privilege
- 2FA and strong password policies
- SAML 2.0 & LDAP/AD for enterprise
- Access rights revoked on departure
Infrastructure & network
- Hosted on T Cloud
- Per-customer virtual network isolation
- Production firewalls
- Encrypted remote access via VPN
Vulnerability & patch management
- Dependency review and control
- Regular container vulnerability scans
- Prioritized patches & hotfixes
- Antivirus and malware protection
Logging & accountability
- Data accesses and changes are logged
- Actions traceable to user accounts
- Documented permission concept
Privacy by design
- Privacy by Design & Default (GDPR Art. 25)
- Need-to-know access for all staff
- Employee privacy training
Trust Center
Everything your security, privacy and procurement teams need to review amber, in one place.
- Certificates and attestations: ISO 27001, GDPR, EU AI Act
- Contracts and documents to download, in German and English
- Our technical and organisational measures at a glance
- Our sub-processors and a direct line to the security team
Your security questions, answered
Where is the data processed?
The core of our software as well as the index are hosted on the T Cloud. The T Cloud certificates can be viewed here.
By default, we also host our generative AI models there. If models from other providers are required, we source them exclusively from German or European data centers.
How is the data encrypted?
At least TLS 1.2 or higher.
Can we restrict what gets indexed?
Yes. Via app registrations in the cloud or service users on-premise, customers have full control over what is accessible through amber, so specific areas can be completely excluded.
How long is data stored after the contract ends?
Up to a maximum of 30 days. After that, it is fully deleted in accordance with GDPR.
Is customer data used to train AI models?
No.
Which security standards does amber meet?
- ISO 27001
- GDPR
- EU AI Act
- SOC 2 aligned, not certified
What happens in case of a data protection incident?
amber has clearly defined processes for identifying and reporting data breaches. Every suspected case is carefully investigated. Confirmed incidents are reported to the responsible authorities within 72 hours in line with GDPR requirements.