# Security and data protection

> Hosted exclusively in a German data center (Nuremberg), encryption throughout, a cryptographic hash chain, DPA, TOM and deletion policy. eIDAS and ISO 27001.

Source: https://smartdocs.de/en/security/

---

Contracts are among the most confidential things a company processes digitally. SmartDocs answers the most important question first: your data stays in Germany.

## Infrastructure

- Data center in Nuremberg, ISO 27001 certified. All documents, signatures and evidence data are processed and stored exclusively in Germany.
- No transfer to third countries: no US cloud, no standard contractual clauses, no transfer impact assessment needed.
- Encryption on every path: TLS 1.2+ in transit, AES-256 at rest.
- Role-based access (owner, admin, member) per organization, and on the Enterprise plan also custom roles built from individual permissions. API keys carry their own role and can be revoked at any time.

## Evidence integrity through the hash chain

Every event in a signature request receives a SHA-256 hash that includes the hash of the previous event. If even a single byte is changed afterward, the chain visibly breaks. For every event, the timestamp, IP address and device are recorded. Every completed request comes with a completion certificate as a PDF and a full evidence export.

## Compliance

- eIDAS compliant: all three signature levels under EU Regulation 910/2014. QES is issued through qualified trust service providers.
- GDPR package: SmartDocs provides a data processing agreement (DPA), TOM documentation (technical and organizational measures) and a deletion policy.
- ISO 27001: information security management to the international standard, from the data center to the development process.

You can request documents for your data protection or security review via the [contact form](/en/contact/).