For procurement and data protection
Trust & security
What law firms, practices and enterprises check before deploying is collected here: where processing happens, how it is protected, what is committed — and which documents you get for it.
Processing in Germany
Application, database, storage, backups and models run in data centres in Germany. The only, temporary exception is mail delivery.
99.5% availability
Per calendar month, planned maintenance excluded — measurable live on the status page.
DPA under Art. 28
Ready to sign as a PDF, with the TOM annex and the list of subprocessors.
Reporting channels
security.txt for security researchers, support@vryne.com for everything else — answered within three working days.
Technical and organisational measures
Art. 32 DSGVOThe summary of what a security questionnaire asks first. The full annex is part of the DPA.
Access control
Every request checks authorisation server-side; the role is verified against the membership table on every request, never taken from the client.
Tenant separation
Documents, text sections, chats and vectors each belong to exactly one organisation. The boundary is in every query and is tested against a real database.
Encryption
Transport exclusively via HTTPS with HSTS for one year. Access to document storage only through organised, signed key paths.
Availability and backups
Daily database backup by the hosting provider, no replication outside Germany, monitored restarts. Status page and health endpoint measure live.
Logging
Uploads, invitations, role and setting changes are recorded in the organisation’s activity log — traceable for the question that comes later.
Data minimisation
No advertising or profiling cookies. Reach measurement is cookieless via an EU endpoint and can be switched off.
Operations and incidents
The status page measures database, queue, storage and search live. Outages lasting longer than one hour are reported by e-mail to the admins of the affected organisations. In the event of a security incident affecting your data, we inform you without delay.
The committed availability is in the terms of use.
Documents
DPA as PDF (German)
Data processing agreement under Art. 28 GDPR, with the TOM annex and subprocessors. Ready to sign.
Subprocessors
Who besides us is involved in processing — with seat, purpose and place of processing.
Report a vulnerability
Reporting channel, response time and scope — also as security.txt.
Status
Live check of all dependencies.
Questions about the review?
Security questionnaires, TOM evidence or a conversation about the DPA: support@vryne.com. We answer within three working days.