Last updated: 29 May 2026

Technical and Organizational Measures

This English version is provided for convenience. If legal interpretation differs, the German version applies unless mandatory law provides otherwise.

1. Physical and access protection

Operation is based on cloud and server infrastructure with role-based access. Administrative access is limited to authorized persons. User accounts support secure passwords, two-factor authentication and passkeys. SSH and administrative access must be limited to authorized keys, users and required networks.

2. Application access control

clutr separates data through users, workspaces, roles and permissions. Workspaces restrict visibility of documents, folders, search results, API uploads and email imports. Roles such as owner, admin, member and read-only limit management and write permissions.

3. Encryption

Transmission uses HTTPS. Documents may be stored encrypted in S3. Databases, backups and storage objects should be operated with server-side encryption where possible. Secrets such as API keys, database credentials and tokens are managed separately from source code and publicly accessible files.

4. Logging and traceability

Technical events, errors, import jobs, API usage, payment events, security events and relevant administrative actions may be logged. Logs serve operation, security, error analysis and evidence. Access to logs is restricted to authorized persons.

5. Backup and recovery

Databases, configurations and stored documents are protected through cloud backup mechanisms, snapshots or backups. Recoverability should be tested regularly. Backups must be protected from unauthorized access and retained only for defined periods.

6. Availability and load control

The application uses server-side capacity controls and queues to absorb processing peaks. Monitoring for server load, storage, errors, queue states and external services is provided where appropriate. Critical updates and restarts are performed in a controlled manner.

7. Malware protection

Uploads may be scanned automatically for malware. Virus signatures and security components are updated regularly. Suspicious or detected malicious files are blocked or not processed.

8. Tenant separation

The application uses workspace IDs, user IDs and role-based checks to logically separate data of different customers and workspaces. Changes to folder logic, search, export and upload are checked against this separation.

9. Development and change management

Changes are technically checked before deployment. Syntax and functional tests, code reviews, secure configuration and controlled deployments reduce the risk of misconfiguration. Production access and production data must be separated from development purposes.

10. Deletion and data minimization

Deletion should cover document files, OCR text, metadata, search index, S3 objects, temporary files and export archives. Data is processed only to the extent required for the respective functions.

11. Incident response

A defined personal data breach process exists for security and data protection incidents. Incidents are assessed, contained, documented and, where required, communicated to customers and supervisory authorities within statutory deadlines.