Security you can verify.
A naturalization or residence procedure is one of the most sensitive administrative matters there is. That is why we host in Germany, additionally encrypt application data at the application layer, and disclose every service provider we use — all documented on this page.
Hosting & Architecture.
The civitas. platform — application, database, and document uploads — runs on servers operated by Hetzner Online GmbH in Germany. Individual, clearly delimited functions use specialized service providers in the EU and the USA — fully disclosed in Category 03.
Encryption.
Encryption takes place in transit and at rest. Sensitive application data are additionally encrypted at the application layer, so that even direct access to the database without the application key shows only ciphertext.
Service Providers & Data Processors.
civitas. uses a small number of clearly delimited service providers — each with a defined purpose. If a provider processes data in the USA, we disclose this openly; such transfers are safeguarded by the guarantees under Art. 44 ff. DSGVO (EU Standard Contractual Clauses or the EU-US Data Privacy Framework).
This register is updated whenever a change occurs. Details on the purposes, legal bases, and storage periods for each service provider are set out in the Privacy Policy.
Data Processing.
Two roles, clearly separated: toward private customers, civitas. is the controller under Art. 4 Nr. 7 DSGVO — with our service providers we have agreements under Art. 28 DSGVO insofar as they act as processors. For institutional partners (law firms, advisory centers), civitas. acts as a processor under Art. 28 DSGVO on the basis of a data processing agreement.
For private customers who use civitas. themselves, civitas. is the controller under Art. 4 Nr. 7 DSGVO — here the Privacy Policy applies, not a data processing agreement.
Data Subject Rights.
You can exercise your rights under the DSGVO toward civitas. at any time — informally, free of charge, and without giving reasons. We process requests within the statutory period of one month (Art. 12 Abs. 3 DSGVO).
Incident Response.
In the event of a personal data breach, the following applies: notification of the competent supervisory authority (LDI NRW) without undue delay and, where feasible, within 72 hours under Art. 33 DSGVO — and, where a high risk is likely, notification of the affected individuals without undue delay under Art. 34 DSGVO.
Procedure for security incidents.
Detect, contain, report, review — in that order. Affected individuals and the supervisory authority are informed as early and as transparently as the state of the investigation allows.
Compliance.
An honest status instead of compliance theater: what applies today and what comes next — clearly separated into Met and Planned.
A direct line for security and data protection.
For data protection inquiries, security reports, and questions about our architecture. If you suspect a security vulnerability, we ask for a confidential report by email — also available in machine-readable form at /.well-known/security.txt.