Data processing agreement (DPA)

When this agreement changes, this section names what has changed compared with the previous version. The text of the agreement governs.

between the Customer as defined in the miphu Terms of Use

- "Controller" -

and

SwiftLabs UG (haftungsbeschränkt), Schanzenstraße 19, 90478 Nürnberg, Germany, Amtsgericht Nürnberg, HRB 46502, represented by its managing director Felix Straub

- "Processor" -

This agreement is concluded in electronic form (Art. 28(9) GDPR), together with the Terms of Use, in the purchase flow of the app or the web app (section 20(1) of the Terms of Use). The Processor stores the version and time of acceptance with account and company.

(1) The Processor processes personal data on behalf of the Controller to the extent necessary to provide miphu under the Terms of Use. Terms defined in the Terms of Use have the same meaning here.

(2) This agreement does not cover processing for which the Processor is itself the controller: the contract with the Customer and the Owner's details for it, correspondence with support, the subscription and its billing, protection of the service including the records of sign-in attempts and network ranges, the registration of devices for notifications, the apps' crash and performance reports, the website miphu.com and the Processor's own records under section 12(7) of the Terms of Use. These are described in the privacy policy at miphu.com/privacy.

(3) This agreement applies for as long as the contract for the use of miphu exists, and afterwards until all personal data of the Controller has been deleted or returned under section 10.

(1) The purpose is to provide miphu as software for CRM and customer service, quotes, orders, invoices with payment reminders and dunning notices, expenses, bookkeeping, tasks, documents including contracts, items, stock, purchasing and deliveries, personnel management including applications, pay, the preparation of payroll and taking over its result, shift planning, recording working time and insights for the Controller and its Users.

(2) Processing includes in particular collecting, storing, organising, retrieving, displaying and transmitting to the Users' apps and the web app, generating business documents and exports, sending emails to Users, checking, reading and recognising uploaded files, imported tables and emails to the inbound address, providing documents and quotes through links for customers, released personnel papers to the person they concern and calendars (section 12a), recording a customer's decision on a quote and their withdrawal, accepting enquiries through the Controller's inquiry form, assigning emails to the inbound address to tickets, reading imported bank statements and payroll journals, posting transactions to the journal, online payment of invoices through Stripe (section 12b), creating shipping labels through Sendcloud (section 12c), taking over orders from a shop on Shopify and reporting to it (section 12d), publishing released product images, recording working time Users enter, creating tasks and draft invoices from contract details and recurrences, delivering notifications through Apple (section 7(3)), transmission to AI apps and entries by them (section 12), keeping the company protocol (Annex 1), backup and restore, and archiving, erasure and removing personal data.

(3) Annex 1 describes the types of data and categories of data subjects.

(1) The Controller is responsible for the lawfulness of the processing, in particular for the legal basis, for informing data subjects under Art. 13 and 14 GDPR and for safeguarding their rights. Section 13 of the Terms of Use additionally applies.

(2) The Controller processes special categories of personal data (Art. 9 GDPR) in miphu only where a function is intended for it and the processing is lawful.

(3) The Controller informs the Processor without undue delay if it detects errors or irregularities in the processing.

(1) The Processor processes the data only on documented instructions from the Controller, including with regard to transfers to third countries, unless required to do so by Union or German law; in such a case it informs the Controller of that legal requirement beforehand, unless that law prohibits such information on important grounds of public interest.

(2) Documented instructions are this agreement, the Terms of Use, and the settings and actions authorised Users of the Controller perform in miphu, such as creating, changing, exporting, archiving and deleting data, creating and deleting Accesses, assigning rights and AI access, switching functions on and off, creating and revoking links, connecting a payment service, an account with Sendcloud or a shop on Shopify, creating shipping labels, initiating refunds, switching on the inquiry form, importing bank statements, confirming matches and approving AI connections. Whatever an AI app does through a connection in the level "Write" or "Full" is an action of the User who approved the connection (section 12(4)). A request an authorised User sends to support in text form (section 9(4) of the Terms of Use) is an instruction to view the data the request concerns and to change it within that User's rights, to the extent handling the request requires; changes are recorded in the change log under "SwiftLabs-Support" (Annex 2). Further instructions are given by the Owner in text form to hello@miphu.com.

(3) If the Processor considers an instruction unlawful, it informs the Controller without undue delay. It may suspend execution until the Controller confirms or changes it.

(4) The Processor carries out instructions that go beyond the functions of miphu where technically possible and reasonable. If the Processor cannot carry out an instruction, either party may terminate the contract for the use of miphu.

(1) The Processor processes the data exclusively for the purposes under section 2. It does not use the data for its own purposes, does not sell it, does not disclose it for advertising and does not use it to train AI models.

(2) It only engages persons who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. The commitment continues after their engagement ends.

(3) It implements the technical and organisational measures under Art. 32 GDPR described in Annex 2. It may develop them further as long as the level of protection does not decrease, and it communicates material changes.

(4) Processing takes place in data centres in the European Union unless Annex 3 states otherwise.

(1) The Controller authorises the sub-processors listed in Annex 3 (general written authorisation under Art. 28(2) GDPR).

(2) The Processor informs the Controller in advance, in text form to the Owner's email address, of any intended addition or replacement of a sub-processor. The Controller may object after receipt for an important data protection reason. If no solution is found, the Controller may terminate the contract for the use of miphu before the change takes effect.

(3) The Processor imposes on each sub-processor by contract the same data protection obligations as set out in this agreement (Art. 28(4) GDPR). Where a provider contracts only on its own non-negotiable terms, its data processing agreement suffices to the extent it meets this requirement; it is named in Annex 3.

(4) The following are not sub-processors: providers the Processor uses only for its own purposes, Apple when selling the subscription and when delivering notifications (section 7(3)), Stripe when billing the subscription and in online payment (section 12b), Sendcloud and the carriers in shipping (section 12c), Shopify for the Controller's shop (section 12d), and the providers of AI apps and calendar apps that a User connects to miphu themselves (sections 12 and 12a).

(5) When handling requests to support (section 4(2)), the Processor uses Claude by Anthropic (Annex 3). Claude receives content the request concerns only to the extent handling the request requires. By way of derogation from paragraph 3, there is no data processing agreement with Anthropic: the Processor uses subscriptions governed by Anthropic's consumer terms, and Anthropic processes the content under those terms and its privacy policy, including in the USA. Training of AI models on this content is switched off in the account settings. This is not assured by contract, and under Anthropic's terms it does not apply to content flagged for safety review or reported as feedback.

(1) Processing outside the EU and the EEA takes place only if the conditions of Art. 44 et seq. GDPR are met. The transfer mechanism for each sub-processor is stated in Annex 3. For Claude (section 6(5)), the Processor agrees no safeguards of its own; Annex 3 states what applies.

(2) If a transfer mechanism ceases to apply, the Processor informs the Controller without undue delay and suspends the affected transfer until another lawful mechanism exists or the Controller has decided.

(3) To deliver notifications, the Processor transfers the data listed in Annex 3 to Apple Inc. in the USA, only for Users who allow notifications on their device. For this transfer there is neither an adequacy decision, nor does Apple provide standard contractual clauses for it; the Processor bases it on Art. 49(1)(a) GDPR. The basis, its limits and the residual risk are stated in Annex 3; the privacy policy informs the Users about them. Subsection 2 applies accordingly. If the Controller does not want this transfer, it instructs its Users to switch notifications off; the transfer then does not take place.

(4) If the Controller is established outside the EU and the EEA in a state for which there is no decision of the European Commission under Art. 45 GDPR, the standard contractual clauses under Implementing Decision (EU) 2021/914, Module 4 (transfer processor to controller), apply to every transfer of personal data from miphu to the Controller and its Users, in particular by display in the apps and the Web App and by exports. They are concluded with this agreement. The Processor is the data exporter, the Controller the data importer. Annex I.A of the clauses follows from the parties to this agreement, Annex I.B from section 2 and Annex 1. Clause 7 does not apply. Clause 17 is governed by the law of the Federal Republic of Germany; for Clause 18, the courts of Nuremberg have jurisdiction. In the event of conflict, the clauses prevail over this agreement.

(5) If the processing for the Controller is subject to the data protection law of the United Kingdom or Switzerland, this agreement also applies as a contract under Art. 28 UK GDPR or under Art. 9 of the Federal Act on Data Protection (FADP) respectively. To that extent, references to the GDPR are references to the corresponding provisions of that law, and references to supervisory authorities also to the Information Commissioner's Office or the Federal Data Protection and Information Commissioner respectively.

(6) If the law to which the Controller is subject requires specific contractual clauses for the transfer to the Processor or for the processing on its behalf, for example standard clauses of another state, the Processor reviews them on the Controller's request in text form and concludes them, to the extent they do not conflict with this agreement or the law applicable to the Processor and do not require a service miphu does not provide. Whether such clauses are needed is for the Controller to assess.

(1) The Controller can primarily answer data subject requests under Art. 15 to 22 GDPR using the functions of miphu, such as viewing, changing, exporting and deleting individual records, deleting Accesses or removing a contact's personal data. Where this is not sufficient, the Processor assists with appropriate technical and organisational measures.

(2) If a data subject contacts the Processor directly, including a User who requests the deletion of their Access, the Processor forwards the request to the Controller without undue delay, where it can identify the Controller, and does not answer it itself.

(3) The Processor assists the Controller with the obligations under Art. 32 to 36 GDPR, in particular data protection impact assessments and notifications, to the extent the information is available to it.

(4) The Controller remunerates assistance that goes beyond the functions of miphu and cooperation on individual cases, unless the Processor is responsible for the cause.

(1) The Processor notifies the Controller of any personal data breach affecting the Controller's data without undue delay after becoming aware of it, to the Owner's email address. The notification contains the information under Art. 33(3) GDPR as far as available; missing information is provided without undue further delay.

(2) The Processor takes measures without undue delay to secure the data and mitigate adverse effects, and documents the breach.

(1) The data is returned (Art. 28(3)(g) GDPR) through the Data Export under section 11(1) of the Terms of Use, which the Owner creates and downloads during the term and after the Subscription ends.

(2) After the end of the provision of processing services, the Processor, at the Controller's choice, makes the data available for export and then deletes it, or deletes it without export. The periods follow sections 8, 11 and 12 of the Terms of Use.

(3) If the Owner deletes the company account, the Processor locks the data for all Users at once, keeps it for 30 calendar days so that the deletion can be reversed on request, and then deletes it automatically from the live system (section 12(2) to (4) of the Terms of Use).

(4) Backups are deleted after no more than 90 days. The data is therefore finally deleted no later than 90 days after the end of the 30-day period under subsection 3. Until then it is protected against access in the backups and used only to restore the service as a whole.

(5) The Controller's statutory retention obligations do not oblige the Processor to keep data for the Controller after the contract ends (section 11(8) of the Terms of Use). The Processor is not aware of any statutory obligation of its own to store the Controller's data; if one arises, it will say so.

(6) The Processor confirms the deletion by email with the day of final deletion; on request it confirms completion of the deletion in text form. It may keep records evidencing proper processing beyond the end of the contract.

(1) The Processor makes available to the Controller the information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by it.

(2) Evidence is primarily provided through information in text form, current documentation and, where available, audit reports or certifications. The evidence of the data centre operators (Annex 3) applies to their services.

(3) The Controller announces an on-site inspection at least four weeks in advance. It takes place during normal business hours, without disrupting operations, and at most once per calendar year, otherwise only for a specific cause stated in text form. Mandated auditors must not be competitors of the Processor and are bound to confidentiality. The Processor does not operate the data centres; their inspection follows the operators' terms.

(4) The Controller bears the cost of inspections unless they reveal a breach by the Processor.

(1) The Processor provides an interface through which authorised Users of the Controller can connect AI apps of other providers, for example Claude by Anthropic or ChatGPT by OpenAI, to miphu. A connection only comes into existence through a User's express approval and only as long as the Controller permits the function in miphu; the Controller can revoke connections at any time.

(2) Through a connection, the Processor transmits, on the instruction of the respective User, the data that this User may see in miphu and has approved, to the AI app the User has chosen, within the scope of section 14(1) and (1a) of the Terms of Use. It transmits documents and personnel data only if the Controller permits this in miphu; both settings are off by default. Notwithstanding sentence 2, it transmits with the area "Scheduling" shifts and requested and approved absences with their period, only as holiday or absence, without type and note, with the area "Working time" the working time the User may see, and with the area "Team" the User's own absences and those the connection enters for others. Absences and personnel papers can contain health data under Art. 9 GDPR. The Controller is responsible for whether the transmission to the AI app is permitted (section 3).

(3) The provider of the connected AI app is not a sub-processor of the Processor. The agreements with that provider and the assessment of the lawfulness of the transfer are the Controller's responsibility.

(4) In the level "Write", the AI app can create and change entries and carry out transactions through a connection, in the level "Full" also delete, archive, cancel and carry out the further transactions of that level, within the scope of section 14(9) of the Terms of Use and only as far as the AI access of the User who approved the connection allows. The Processor processes this as the User's instruction (section 4(2)). Which data the AI app enters, including from other sources, is determined by the Controller with its Users; informing the data subjects is the Controller's responsibility.

(5) For each call, the Processor logs time, duration, result, User, company, AI app, tool and the number of records transmitted, but not search terms or content, and deletes these logs after 90 days. Every change made through a connection is recorded in the change log with the User and the connection. The Processor enforces the limits under subsection 4 technically (Annex 2).

(1) If the Owner has switched on calendar subscriptions (off by default), the Processor transmits, on a User's instruction, that User's dates to the calendar app that retrieves their calendar link, within the scope of section 14a of the Terms of Use. If a task or a contract concerns a confidential or restricted document, the date appears in the calendar without a title.

(2) The provider of the calendar app is not a sub-processor of the Processor. Whether Users may subscribe to calendars is decided by the Controller; assessing whether the transfer is permitted and informing the data subjects are the Controller's responsibility.

(1) If the Controller connects an account with Stripe in miphu, the Processor transmits to Stripe on its instruction: when connecting, the country, the name of the company and the email address of the User who connects; for the payment of an invoice through its payment link, the invoice number, amount, currency and identifiers of company, invoice, link and payment process; for a refund a User initiates in miphu, the payment, amount and identifiers. The payer enters payment details on Stripe's pages.

(2) The Processor retrieves the status of the account and of the payments from Stripe. For payments through a payment link it stores the amount, fee, times, status and payment method, as well as refunds, chargebacks with reason and deadline and the account's payouts; it does not store the payer's name, address or payment details. On a User's instruction it takes over customers from the Stripe account through the import, with name, address, email address, phone number and VAT identification number.

(3) Stripe is not a sub-processor of the Processor. Online payment is a contract between the Controller and Stripe; Stripe processes the data under that contract as the Controller's processor and for its own purposes as a controller. Agreements with Stripe, including on transfers to third countries, and informing the payers are the Controller's responsibility. The Processor holds no money and initiates refunds only on a User's instruction.

(1) If the Controller connects an account with Sendcloud in miphu, the Processor transmits to Sendcloud on its instruction, for a shipping label a User creates from a delivery note: the recipient's name, company and address, the order and delivery note numbers, the sender address, the shipping method, the weight and the line items with description, quantity, weight, price, item number, customs tariff number and country of origin, the order amount and, for a destination outside the European Union, the invoice number; for a cancellation or a return, the shipment.

(2) The Processor transmits the recipient's email address and phone number only if the Controller has switched this on in miphu (off by default) or the chosen shipping method requires them; if it requires only one of the two, only that one.

(3) The Processor retrieves shipping methods with prices, sender addresses and the status of shipments from Sendcloud. It stores the status and its history, the carrier, tracking numbers and the tracking link, the label and customs documents as documents on the delivery note, and the status of returns.

(4) Sendcloud is not a sub-processor of the Processor. Shipping is a contract between the Controller and Sendcloud; Sendcloud processes the data under that contract as the Controller's processor and passes it to the carrier the Controller uses there. Agreements with Sendcloud and the carriers, including on transfers to third countries, informing the recipients and the legal basis for passing on email address and phone number are the Controller's responsibility.

(1) If the Controller installs the app "miphu" in its shop on Shopify and connects the shop to miphu, the Processor retrieves from Shopify on its instruction: the shop's name, domain and identifier; orders from the time of connecting and individual older ones at a User's request, with line items, prices, discounts, taxes, shipping costs, payments, refunds and fulfilments; the buyers with name, billing and shipping address, email address, phone number, language and, for businesses, VAT identification number; products and variants with item number, locations and stock levels.

(2) According to the Controller's settings, the Processor creates customers, orders, invoices, delivery notes and payments from this in the name of the User who connected; they are the Controller's data like any other. To Shopify it transmits the available stock of linked items, fulfilments with carrier, tracking numbers and tracking link and, if the Controller switches this on, the link to the issued invoice.

(3) The Processor stores the installation, the access tokens, the matching of customers and variants, the status of every order and the notifications from Shopify; it deletes their content 30 days after processing. If the Controller disconnects or removes the app, the Processor deletes the access tokens at once. Requests Shopify transmits for the Controller count as the Controller's instructions: for the deletion of the shop's data, the Processor deletes the installation, the matching and the status of the orders; for access to a person's data, it creates a task for the Owner; for the deletion of a person, it deletes the matching and notifications concerning them and a customer the connection created if no business document the Controller must retain is attached to it, otherwise it creates a task for the Owner. Customers, orders, business documents and payments otherwise remain until the Controller deletes them or the company account ends.

(4) Shopify is not a sub-processor of the Processor. The shop rests on a contract between the Controller and Shopify; agreements with Shopify and informing the buyers are the Controller's responsibility. The Processor processes data from Shopify only for the services under this agreement and transmits it to third parties only on the Controller's instruction, for example to Sendcloud (section 12c) or to an AI app a User connects (section 12).

To the extent the Processor processes personal information of consumers within the meaning of the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq., "CCPA") for a Controller that is a "business" under the CCPA, it acts as a "service provider" and

1. does not sell or share that personal information,
2. processes it only for the business purposes set out in section 2, for which the Controller discloses it to the Processor solely,
3. does not retain, use or disclose it for any other purpose, including any other commercial purpose, or outside the direct business relationship with the Controller,
4. does not combine it with personal information received from others or collected from its own interaction with the consumer, except as expressly permitted by the CCPA and its regulations,
5. complies with the applicable obligations of the CCPA and provides the same level of privacy protection as the CCPA requires of businesses,
6. grants the Controller the right to take reasonable and appropriate steps to ensure use consistent with the Controller's obligations (section 11) and, upon notice, to stop and remediate unauthorised use,
7. notifies the Controller if it determines that it can no longer meet its obligations under the CCPA,
8. assists the Controller with consumer requests under the CCPA (section 8), and
9. binds sub-processors by contract to the same requirements, except Anthropic (section 6(5)), and informs the Controller about them (section 6).

Liability is governed by section 19 of the Terms of Use. Claims of data subjects under Art. 82 GDPR and the allocation between the parties under Art. 82(5) GDPR remain unaffected.

(1) In the event of conflict, this agreement prevails over the Terms of Use as regards the protection of personal data.

(2) Changes to this agreement follow section 21 of the Terms of Use; changes to sub-processors follow section 6.

(3) If a provision is invalid, the remainder of the agreement remains valid.

(4) Section 23(1) to (3) of the Terms of Use applies.

The data actually processed is determined by the Controller's use. The list describes what miphu has functions for (as of 28 October 2026).

1. Confidentiality

Physical access and access to systems. The servers are located in data centres of Hetzner Online GmbH; physical access control is a measure of the operator. Server sign-in with SSH keys only; host firewall with default deny; only the ingress service (ports 80 and 443) is reachable from the internet. The database has no public port.

Access to data.

• Passwords only as bcrypt hashes; sign-in attempts limited per IP address and email address. Session and renewal keys only as hashes; a session is valid for at most 30 days. Links in emails are single-use and valid for at most seven days. Account deletion and changing the email address only with the current password and, with two-factor authentication, also the code.
• Two-factor authentication (TOTP under RFC 6238, with any authenticator app) per User; the Owner and the Administration can require it for all Users of the company. It is asked for at every sign-in with password on a device that is not trusted and when approving an AI connection; without a passed check the database opens no session. The secret is sealed with AES-256-GCM, recovery codes and the keys of trusted devices are stored only as hashes. A device stays trusted until the person removes it, two-factor authentication ends or is reset, the password changes or the Access is deactivated.
• Every User has their own Access; rights are assigned per role and area. Pay and the payroll preparation are seen only by the Owner and Users with the Personnel right, one's own pay also by the person concerned, read only; other people's working time only by the Owner and Users with the Personnel or Planning right; corrections of working time stay in the history with reason and previous value.
• For a request to support (section 4(2)), persons of the Processor view the data the request concerns as administrators on the API and database servers, also with the help of Claude (section 6(5)). Viewing is not logged separately. Their changes are recorded in the change log under "SwiftLabs-Support", not under the requesting User, with the reason: who made the request, through which channel and on which day.
• Data Export only by the Owner and authorised Users of the Administration; the archive is deleted seven days after completion.
• Only the Owner and the Administration read the company protocol, an AI connection only in the level "Full"; only the Owner changes its retention.
• Links for customers and calendar links consist of 256 random bits; only their fingerprint (SHA-256) is stored. miphu derives payment links from their identifier with a secret key (256 bits); for them too only the fingerprint is stored. Their pages set no cookie, except the pages for accepting a quote, for withdrawal and for paying an invoice, which bind their form to the browser with a cookie holding a random value; it expires after one hour. Retrievals are limited.
• The inquiry form has an address of 256 random bits, sets no cookie and loads neither scripts nor third-party services. It checks submissions with an invisible field and a time signed by the server and limits them per network range and company; it stores the network range for this for one day.
• The keys for Sendcloud and the access tokens for Shopify are sealed with AES-256-GCM in the database, bound to company and connection; the key for this lies outside database, backup and export. No function discloses them; they are deleted on disconnecting. miphu accepts notifications from Sendcloud and Shopify only with a valid signature.

Web app. The browser talks only to app.miphu.com; its server holds no database and no files. The session is kept encrypted (AES-256-GCM) in a cookie that scripts cannot read. Requests that change something are checked for their origin; a Content Security Policy admits only the app's own scripts and, on the app's start page in the Shopify admin, also Shopify's App Bridge script required there.

Notifications. A notification contains no amounts and no Customer Data beyond the title of the task; the title is cut at 80 characters, and the messages about an opened link, about the decision on a quote or its withdrawal, about a new paper, about online payments, shipments and orders from Shopify name no document. It waits at most 24 hours for delivery. Device tokens are valid per sign-in, account and company and are deleted on sign-out, at the end of the membership and with the account.

Files. A separate server checks every uploaded file for malware before it is released; it reads imported tables without network access. Emails to the inbound address are accepted by a receiving mail server of its own, not by a third-party service.

AI connections. For documents and personnel data, the database checks the area and the setting on every request; the User's rights, tenant separation and input validation apply as in the app. Writing happens only through a tool that expressly writes, over a connection in the level "Write" or "Full", never above the level its User's AI access allows; every other request runs read-only. A transaction such as issuing or cancelling an invoice goes through the same validation as in the app; the database admits only the tables this transaction writes. It admits deleting, hiding, archiving, cancelling, discarding, the trash, removing personal data, exports in DATEV format and for the bookkeeping and changes to the company's settings, to Accesses, rights and departments and to the do-not-contact list only as a transaction of the level "Full" and only for a connection in that level, settings, Accesses, rights, departments and the do-not-contact list only for the Owner and the Administration. It also refuses for AI connections: every other deletion except of lines and partial details replaced when a draft, an item, a routing or an import is changed, and of a document's link to a further record; for quotes, orders, invoices, dunning notices and expenses, every change outside the draft that does not belong to such a transaction; for documents, final deletion, moving, restricting and making them confidential, the legal hold and uploading files over 4 MB, as personnel papers or to the email inbox; personnel data other than absences while the setting under section 12(2) is switched off; changes to AI access and to the settings for AI connections, to the subscription and to recorded working time, deleting Accesses and invitations, and Data Exports. It does not give an AI connection the reason of an entry on the do-not-contact list, and an AI connection does not create entries whose details are on the do-not-contact list. The database itself records the connection in the change log; the number of retrievals and changes per connection is limited.

Tenant separation. Every table holding company data carries a forced row-level security policy that admits only rows of the session's company; it also binds the database functions. Functions that work across companies by their purpose are listed with their reason in the database; a new function that would bypass the policies without being listed stops the release. The service's runtime role has no direct privileges on the tables other than reads bound by policies; some operational functions and the final deletion can be called only by the database administrator.

Encryption. Transport over TLS, also between the servers with verification of the other side's certificate. Uploaded files are encrypted with AES-256-GCM and a key of their own per company, which is stored only in encrypted form under a master key kept outside the database, backups and file storage; when a company is finally deleted, its key is deleted. Only published article images are stored unencrypted and, until they are filed, usually for seconds, emails in the spool of the receiving mail server.

Operations. API, worker and web app containers run with a read-only file system, without Linux capabilities and with resource limits; each service receives only its own secrets; the API server holds neither the database administrator password nor backup material.

2. Integrity

• Issued invoices, payment reminders and dunning notices are immutable; number ranges are gapless; corrections are made by reversal.
• Changes and their change-log entries are written in the same transaction; permanent deletion is logged without personal data.
• Entries of working time are only appended and chained per person by checksums (SHA-256).
• Journal entries are fixed when recorded; the database lets them be neither changed nor deleted, corrections are made by reversal, and per company they are chained by checksums (SHA-256) that miphu recomputes. A closed period does not reopen.
• Entries of the company protocol are only appended and chained by checksums (SHA-256) within each chain; the database lets no one change or delete them, except deleting the network range after 90 days and removing the oldest entries once the retention has passed, which the protocol itself records. The check in miphu recomputes the chains; every export of the protocol carries their latest state.
• Access logs at the ingress are disabled because URLs contain one-time keys. Sign-ins to the servers and programs administrators run on the API and database servers are logged.
• The database runs with data page checksums.

3. Availability and resilience

• Two instances each of the API and the web app, replaced one at a time during updates.
• Continuous, encrypted backup of the database on the database server and on a Hetzner Storage Box, plus a daily logical backup. Backup retention: no more than 90 days.
• Uploaded files in Nuremberg and as a second copy in Falkenstein; the second copy is in a separate project whose credentials the API server does not hold.
• Monitoring of the servers with alerts and an external heartbeat.

4. Process for regular review

• Weekly restore drill into a separate cluster with verification of all page checksums.

Delivery of notifications (section 7(3)), not a sub-processor under section 6(4):

Not sub-processors for the Controller's data:

• Apple sells the subscription under its own responsibility and receives no Customer Data from miphu for it.
• Stripe (Stripe Payments Europe, Limited, Ireland) handles the payments for a subscription in the web app and receives for this the Controller's billing details as a customer of the Processor and the payment details, no Customer Data from miphu. In online payment Stripe is the Controller's contracting party, not the Processor's (section 12b).
• Sendcloud (Sendcloud Global B.V., Eindhoven, Netherlands, and affiliated companies) creates shipping labels through the Controller's own account and passes the details to the carriers the Controller uses there; in doing so Sendcloud is the Controller's contracting party and processor, not the Processor's (section 12c).
• Shopify operates the Controller's shop under the Controller's contract with Shopify; the Processor only offers the app "miphu" in the Shopify App Store (section 12d).
• Hostinger International Ltd. operates only the website miphu.com.
• Providers of AI apps and calendar apps receive data only through a connection or a calendar link that a User sets up themselves (sections 12 and 12a).
• Healthchecks.io (SIA Monkey See Monkey Do, Riga, Latvia) receives only a heartbeat from the servers, without personal data.
• The mailbox hello@miphu.com is hosted by Apple (iCloud Mail). If a customer sends Customer Data by email, Apple processes it.