Data stays in Germany.
Naturalisation is a highly sensitive administrative procedure. We handle the resulting data accordingly — with a clear GDPR architecture, hosting exclusively in Germany, and transparent sub-processors.
Hosting & architecture.
The entire civitas. platform runs on servers in Germany. No data traffic outside the EU, no sub-processors headquartered in third countries for core data — and an architecture designed to be multi-tenant (mandantenfähig) so that every authority and every institutional partner receives its own, isolated data space.
Encryption.
Encryption takes place both in transit and at rest. Sensitive application data is additionally encrypted at the application layer, so that even access to the database without the application key reveals no readable personal data.
Subprozessoren (subprocessors).
civitas. uses selected service providers for clearly delimited tasks. All sub-processors are contractually bound by the DSGVO, with AVV under Art. 28 DSGVO. The location is transparently documented — where possible, providers with their headquarters and data processing in the EU are preferred.
The list is updated when changes occur. Authorities and institutional partners are informed of material changes to the sub-processor register. A complete sub-processor catalogue is part of the AVV (data processing agreement).
Auftragsverarbeitung (data processing on behalf).
When civitas. processes data for institutional partners (Behörden, law firms, counselling centres), this happens exclusively on the basis of an Auftragsverarbeitungsvertrag (data processing agreement) under Art. 28 DSGVO. The AVV automatically becomes part of the licence agreement and is available in standardised form.
The AVV (data processing agreement) is designed for institutional clients (authorities, law firms, counselling centres). For private customers who use civitas. themselves, civitas. is the controller under Art. 4 No. 7 GDPR — here the Privacy Policy applies, not an AVV.
Data subject rights.
Applicants and all other affected persons may exercise their rights under the DSGVO (German GDPR) towards civitas. at any time. We process requests within the statutory one-month deadline pursuant to Art. 12 Abs. 3 DSGVO (GDPR Article 12(3)).
Incident response.
Security incidents are handled according to a clearly documented process — with defined Eskalationsstufen (escalation levels), notification deadlines, and subsequent Ursachenanalyse (root cause analysis). In the event of a Verletzung des Schutzes personenbezogener Daten (personal data breach), notification to the Aufsichtsbehörde (supervisory authority) under Art. 33 DSGVO (GDPR) is made within 72 hours.
Procedure for security incidents.
From detection of an incident to restoration of regular operation, we follow a standardized process. Clients and affected parties are informed as early as possible, transparently and traceably.
Compliance.
An honest status: which standards we meet today, which certifications are currently in progress, and which are planned for 2026/2027. We communicate this transparently rather than performing compliance theatre.
Direct contact for security and Data protection.
For security reports, data protection enquiries, audit requests or specific questions about our architecture. In the event of suspected security vulnerabilities, we ask for confidential reporting — we confirm receipt within 24 hours.