Security & data protection

Data location & EU hosting

The Kontier platform runs in European data centres: application, database and secret management at OVH in France, further infrastructure and email delivery at providers that process in the EU/EEA. Platform data is processed in the EU.

There is one exception, and we name it: payment data processed by Stripe can be transferred to Stripe, Inc. in the United States, under the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses. The subprocessor register lists every provider with its seat and processing location.

Protection against unauthorised access

Kontier is secured in layers, so that a single mistake doesn't immediately expose data. All traffic runs encrypted over TLS; unencrypted connections are rejected and blocked via HSTS. Access is tied to a sign-in through our identity provider (Keycloak / OIDC), and every access token is verified cryptographically. API keys are never stored in clear text, only as a hash; webhooks are HMAC-signed; requests are rate-limited.

The most important line of defence sits in the database itself. Each tenant is separated from every other at the row level via row-level security, and the application runs under a database role that cannot bypass that separation in normal operation. The tenant boundary is therefore not drawn in application code alone but enforced by PostgreSQL: an additional layer that holds even if a mistake is made above it.

Operations are built for a small attack surface, too. Credentials and keys are not kept in source code or in Git but in a separate secret manager, from which they are loaded only at runtime. The database is not publicly reachable; the application containers run without root privileges and with restricted kernel access. The platform runs on managed Kubernetes in the EU, kept continuously patched. We take automatic, encrypted backups of all data, kept for at least 30 days, with point-in-time recovery, complemented by a high-availability replica with automatic failover.

At Kontier, GDPR compliance is not an add-on but a foundation of the architecture. The hosting and infrastructure providers we use act as processors within the meaning of Art. 28 GDPR, and data processing agreements are in place with each of them. Which providers these are is listed in our public subprocessor register. The data processing agreement (DPA) for the business use of Kontier is Annex 2 of our terms; a signed copy is available on request at contact@frontieralgorithmics.com. Which personal data is processed for which purposes and on which legal basis is fully documented in the Privacy Policy.

GoBD-compliant archiving & audit log

Records stay traceable and audit-proof. Kontier provides a GoBD-compliant audit trail with archiving. Tax rules are shipped versioned and are fully traceable in the audit log. The accounting is designed to be replay-safe: plans, prices and products are versioned, every subscription pins to an immutable plan_version, and catalog edits never silently mutate live invoices. For each invoice, the FX rate and tax rule are frozen at finalize; existing records remain untouched.

Analytics, cookies and ad measurement

Without your consent, kontier.eu loads no advertising or tracking scripts and sets no tracking cookies. For audience measurement we use the open-source web analytics tool Umami, which we run on our own infrastructure under analytics.kontier.eu: cookie-free and with no transfer to third parties. Contact and demo requests and the newsletter run through Brevo (France, processing in the EU) as a processor.

If you agree to the marketing category in the cookie banner, we measure conversions with Google Ads, and Google sets cookies for that. You can withdraw consent at any time in the . Details are in the web analytics, Google Ads and cookies sections of the Privacy Policy.

Company & accountability

The operator and controller within the meaning of the GDPR is:

Frontier Algorithmics UG (haftungsbeschränkt)
Koppoldstr. 1
86551 Aichach, Germany

Full mandatory information is available in our Legal Notice; the competent supervisory authority and your rights as a data subject are listed in the Privacy Policy.

A note on how we communicate: this page states only what is actually true today: no invented certifications and no promises we do not keep. When a certification is achieved, it will be listed here, not before.

For your security review

Answers to the first questions of a security questionnaire, each with the place where it is stated. Where we do not publish a detail here, it says "on request": write to security@kontier.eu.

Encryption in transit: TLS 1.2 or higher; unencrypted connections are rejected, HSTS is on. Section 02
Encryption at rest: AES-256. DPA, Annex 5 (TOMs), 5.1
Tenant isolation: Row-level security in PostgreSQL, in addition to the separation in application code. Section 02
API keys and webhooks: Keys stored only as a hash, webhooks signed with HMAC-SHA256. Section 02
Staff access: Only for support, security or required maintenance, and logged; personal accounts with enforced multi-factor sign-in. TOMs 5.1 and 5.5
Single sign-on: SSO via SAML or OIDC on the Enterprise plan. Pricing
Backups: Daily, encrypted, kept for at least 30 days; plus point-in-time recovery and a high-availability replica. TOMs 5.3
Data location: Platform data in the EU (OVH, France). Payment data processed by Stripe can go to the US (DPF and SCC). Register
Subprocessors: Public register. DPA customers are told about changes at least 30 days ahead in text form. DPA 2.7
Breach notification: Without undue delay, at the latest 24 hours after we become aware. DPA 2.10
End of contract: 30 days to export, then deletion; backups are overwritten in the backup cycle. Terms 7.4, DPA 2.12
Penetration tests: Contractually at least once a year by independent third parties. Date and summary of the latest test: on request. TOMs 5.4
Certifications: None of our own. Our hosting partners' data centres are ISO 27001 certified; ISO 27001 and BSI C5 are on the roadmap. Roadmap
Disaster recovery (RTO, RPO): On request.
DPA: Part of the terms (Annex 2); a signed copy on request. Terms, Annex 2

Contact for security matters

Please report a possible vulnerability to security@kontier.eu; the machine-readable version is at /.well-known/security.txt. For data-protection questions, a DPA or general enquiries, write to contact@frontieralgorithmics.com or use the contact details in our imprint.