Security, privacy and compliance: documented, not promised.

tchop GmbH operates an information security management system certified against ISO/IEC 27001:2022 by TÜV SÜD. The most recent re-certification and transition audit took place in October 2025 and recorded no nonconformities. The next surveillance audit is scheduled for Q4 2026.

What is certified: hosting, operation and development of software as mobile and web applications and corresponding interfaces to other applications. The certified entity is tchop GmbH, Berlin. The scope excludes no part of our business.

For the tchop platform, tchop GmbH acts as data processor on behalf of its customers. The customer remains the controller and determines purposes and means of processing. tchop GmbH is the controller only for this website.

The tchop platform runs on Amazon Web Services in the Frankfurt region (eu-central-1) or on Hetzner Cloud in Germany. Both providers are ISO/IEC 27001 certified and publish SOC 2 reports, which we collect and review annually as part of our supplier assessment.

Enterprise customers choose their hosting: either Amazon Web Services in Frankfurt or Hetzner in Germany, optionally as a fully separate customer environment or an on-premise installation. Whichever you choose, the other provider processes nothing for you, and processing stays within the agreed jurisdiction.

In transit. All traffic between clients and our systems is encrypted with TLS 1.2 or higher and forward secrecy. Our cryptographic standards follow NIST FIPS 140-3 guidance and are re-verified annually.

At rest. Customer data is encrypted at rest with AES-256. On AWS, databases, block storage and object storage are encrypted with keys managed in AWS KMS. On Hetzner, equivalent AES-256 key management plus LUKS volume encryption on the database host. All company laptops use full-disk encryption (FileVault, XTS-AES-256). Keys are inventoried, reviewed and rotated annually; the last review was approved in October 2025.

Chat. Chat messages are encrypted in transit with TLS 1.2 or higher and stored encrypted at rest with AES-256 on servers in the EU.

Passwords. User passwords are never stored in plain text. They are protected with a salted one-way hashing function.

Our access. Production access follows least privilege with deny-all provisioning. Administrative access to production servers and databases is granted only on documented job need, every account is individually traceable, and multi-factor authentication is mandatory for company email, version control and cloud infrastructure. Second factors and ownership roles for the most sensitive systems are held by management. Production and test systems are reachable only over our company VPN, which enforces multi-factor authentication and AES-256 with split tunnelling disabled. Administrator access uses SSH key pairs, which are inventoried and rotated annually.

Access rights are reviewed and documented quarterly by our CEO and Information Security Officer. The most recent review is dated 25 September 2025. Access is revoked within 24 hours of an employee's last day, and unapproved access is itself treated as a security incident.

Your users. Several onboarding paths: invite users directly by email with role-appropriate credentials, generate one-time access codes where you cannot or do not want to email your users, or connect your own identity provider via SAML 2.0 or OpenID Connect. Both are in production with Microsoft Entra ID and Okta, including mapping your directory groups to channels and roles. With SSO connected, authentication, password policy and multi-factor enforcement stay in your identity provider, and tchop re-verifies user attributes on every login.

Our architecture grants the minimum required access between systems. Database servers are reachable internally only, all traffic to application servers is routed through our proxies and gateways, and no other system in our data centres has direct inbound or outbound internet access. Access control follows zero trust principles: continuous verification, least privilege and segmented access.

Network traffic is filtered by AWS security groups at the TCP and IP layers and by an enterprise Fortinet firewall at our Berlin office. AWS WAF runs in front of our CDN and load balancers, with web filtering rules reviewed quarterly.

Distributed denial of service traffic is absorbed by AWS Shield Standard together with AWS WAF rules, CloudFront edge caching and rate limiting at the API gateway. Our DDoS response was rehearsed in a tabletop exercise in 2025.

We collect audit logs from production systems, databases, repositories, cloud infrastructure and identity activity. Logs are monitored continuously through Grafana, Sentry and AWS CloudTrail, with alerts routed to dedicated Slack channels and email so the team can respond quickly.

Security incidents can be reported to support@tchop.io at any time, by our team, by customers, or by external researchers. Every report is triaged by our CEO and Information Security Officer against defined severity levels, with a 24-hour reaction target for high-severity incidents, and an incident ticket is opened within 24 hours of a report. Where personal data of EU individuals is affected, we notify the competent authorities and affected data subjects within 72 hours. Our incident response plan is tested annually and every incident closes with a documented post-mortem.

We take daily encrypted backups of all production databases and volumes. Recovery objectives are defined per service: our production database has a one-hour recovery time objective and a zero-data-loss recovery point objective, our backend and API a two-hour recovery time objective, our admin and CMS layer four hours. Backup restoration is tested on a documented schedule.

Key services run with redundancy and failover inside our production region, including managed database clusters and load balancers.

We commit to 99.9% availability contractually. Backend uptime is measured continuously and reviewed quarterly as part of our ISMS monitoring.

Our business continuity and disaster recovery plan is reviewed and tested at least annually. Beyond restore testing we run documented tabletop exercises against realistic scenarios, including ransomware, a cloud account breach, an escalating denial of service attack and a full hosting failure.

Code changes follow a documented change management process. Automated tests cover functions that affect compatibility, operations or security. Changes are peer-reviewed against a secure coding checklist derived from the OWASP Top 10 and the CWE/SANS Top 25, covering input validation, output encoding, hardcoded secrets and sensitive data in logs. Major features are threat-modelled using STRIDE. Separation of duties applies: the engineer who writes a change is not the one who deploys it.

Development, staging and production run as separate environments with separate databases and separate access control, and staging is additionally IP restricted. Production data may only be used for testing with named approval per occasion, must have personal data removed or obscured, and is deleted after the test.

Developers complete secure coding training at least annually and work from an approved list of vetted open-source libraries.

Our systems are scanned daily: network scans with OpenVAS, passive and active web application scans with OWASP ZAP, and TCP and UDP port scans with NMAP. Dependencies are monitored continuously with Dependabot, and our CI pipeline runs a dependency audit on every deploy that fails the build on high or critical findings.

Findings are rated against CWE and WASC, entered into our risk register, and scan metrics including mean time to remediation and recurring vulnerabilities are reviewed quarterly at management review. We track threat intelligence from CISA, the NIST National Vulnerability Database and vendor advisories as part of our incident response process.

Background checks are required for all personnel. Every employee and contractor signs a confidentiality agreement before being given access to sensitive information, and commits to confidentiality in the processing of personal data in line with Art. 28(3)(b) GDPR.

Every employee and contractor completes security awareness training at onboarding and annually thereafter, currently the ESET Cybersecurity Training programme, covering phishing, password management, information classification and physical security, plus a mandatory module on AI and the EU AI Act. Completion is tracked per person with an end-of-course knowledge check and a follow-up survey. Our Information Security Officer runs an all-hands security session twice a year. Developers additionally follow our Secure Development Policy.

Company devices are centrally managed. Laptops and smartphones are enrolled in mobile device management, full-disk encryption is enforced, sessions time out automatically, and a clear desk and clear screen policy applies. Contractors using their own device management must evidence equivalent compliance.

Every enterprise agreement includes a Data Processing Addendum under Art. 28 GDPR (Annex 4), the details of the processing (Annex 5), our current subprocessor list (Annex 6) and our technical and organisational measures (Annex 7). All four are available for legal review before signature. Our subprocessor list is published and maintained on this page, and material changes are announced in advance.

Rather than asserting compliance, here is what we can show you:

• An information security management system certified against ISO/IEC 27001:2022 by TÜV SÜD, with annual internal audits, most recently September 2025.
• A named data protection officer.
• A documented deletion concept: customer data is disposed of within 30 days of a request by a current or former customer, device media is erased following NIST SP 800-88 Rev. 1, physical media is destroyed by a certified partner, and every disposal is logged.
• A documented incident response plan committing us to notify authorities and affected data subjects within 72 hours.
• A supplier security process: security assessment before any third party is used, annual review of SOC 2 reports and ISO 27001 certificates for high and medium risk vendors, and written confirmation of deletion or return of data within 60 days of termination.
• Processing on AWS Frankfurt or Hetzner Germany at your choice, with chat data stored encrypted on European servers only.