Trust Center

German provider and contracting party headquartered in Düsseldorf. The customer application runs on Render in Frankfurt; object data is stored in Amazon S3 eu-central-1.

Made in Germany

Development & operations in Düsseldorf

GDPR-compliant

DPA, TOMs & subprocessor list

Core hosting in Germany

Render Frankfurt · S3 eu-central-1

Access credentials protected

TLS · Tokens and API access AES-256-GCM

Enterprise-ReadyVendor-onboarding-ready for DAX companies & the German MittelstandDPA, TOMs & TIA available within 24 hAuditable in accordance with § 9 AVVNIS-2-ready supply chains

Core hosting in Germany: Render Frankfurt and Amazon S3 eu-central-1. Further processing operations and any third-country transfers are documented in the subprocessor list.

Compliance at a glance

Everything your privacy and procurement teams review.

Order processing pursuant to Art. 28 GDPR

Signature-ready DPA

Technical & organisational measures

Art. 32 GDPR

Notification of data breaches

within 24 hours to the client

Record of processing activities

Art. 30 GDPR

No special categories (Art. 9)

Business B2B contact data only

Privacy by Design & by Default

Privacy-friendly default settings

Annual penetration tests

Independent third parties, monthly scans

Employee training

Privacy & InfoSec, mandatory annually

ISO 27001 / SOC 2 Type II / BSI C5

Roadmap – in preparation

Incident response process

Oriented towards NIS-2

Made in Germany

Completely German. Completely enterprise-ready.

amplifa is a German company with a German contracting party and its product and engineering team in Germany. The core application is operated in Frankfurt; further processing operations are disclosed transparently in the subprocessor register.

Registered office & development in Düsseldorf

amplifa GmbH, Luisenstraße 9, 40215 Düsseldorf. Registered in the commercial register of the Düsseldorf Local Court. Product and engineering team 100% in Germany.

Core hosting in Frankfurt

Rails 8 application, PostgreSQL, Redis and background workers on Render in Frankfurt; object data in Amazon S3 eu-central-1. Provider certificates apply to the respective service provider.

German law, place of jurisdiction Düsseldorf

T&Cs based on the German Civil Code (BGB)/German Commercial Code (HGB), German contracting party, exclusive place of jurisdiction Düsseldorf. No US or offshore contracting constructs.

German-language support

Sales, Customer Success, Security and Privacy speak German. Named contact persons, no offshore hotlines.

Compliance stack DE & EU

GDPR, BDSG (Federal Data Protection Act), UWG (Act Against Unfair Competition), NIS-2 Readiness Statement, EU AI Act declaration of conformity, BSI C5:2020 self-assessment, Transfer Impact Assessment (Schrems II).

Taxes & accounting in Germany

Invoices with German VAT (VAT ID DE458632719), HGB-compliant bookkeeping, payment via SEPA direct debit or bank transfer.

amplifa GmbH · Luisenstraße 9 · 40215 Düsseldorf · Germany. Contracting party for all commercial relationships. Third-country processing by individual subprocessors is disclosed in AMP-TC-003 and secured with appropriate safeguards.

Policy map

The 10 core policies of a European SaaS company.

Our policy map covers the core requirements from GDPR, NIS-2, the EU AI Act and ISO/IEC 27001. Each policy links to the corresponding signed document in the Trust Center.

01ISO/IEC 27001:2022

Information Security Policy (ISMS Master)

Overarching security policy as the foundation of the entire ISMS.

AMP-TC-024

02GDPR Art. 13/14

Data Protection / Privacy Policy

Transparent information about the processing of personal data.

AMP-TC-004

03GDPR Art. 28 & 30

Record of Processing Activities & TOMs / DPA

Register of all processing activities, technical measures and DPA.

AMP-TC-025AMP-TC-002AMP-TC-001

04GDPR Art. 33 · NIS-2

Incident Response Plan

Detection, handling and 72-hour notification of security-relevant incidents.

AMP-TC-007

05EU AI Act

AI Governance / AI Usage Policy

Rules for the selection, use and oversight of all AI systems.

AMP-TC-015AMP-TC-019

06GDPR Art. 5 (1)(e)

Data Retention & Deletion Concept

Retention periods and deletion procedures per data category.

AMP-TC-026

07GDPR Art. 32

Access Control & Identity Management

Least privilege, MFA, lifecycle and reviews of all access rights.

AMP-TC-010

08GDPR Art. 28 · Schrems II

Vendor / Third-Party Management

Selection, assessment and ongoing management of all subprocessors.

AMP-TC-027AMP-TC-003

09NIS-2

Business Continuity / Disaster Recovery

Ensuring the availability of critical services, RTO/RPO, failover.

AMP-TC-028AMP-TC-008

10ISO 27001 · NIS-2 · EU AI Act

Risk Assessment & Management

Risk methodology with 5×5 matrix, acceptance criteria and risk register.

AMP-TC-029

Document library

All documents for your vendor review.

Request all documents as a ZIP

On request (after NDA)

On request

AMP-TC-001

Data Processing Agreement (DPA, Art. 28 GDPR)

v2.1 · As of: September 2026

Request document

On request

AMP-TC-002

Technical and organisational measures (TOMs, Art. 32 GDPR)

v2.1 · As of: September 2026

Request document

On request

AMP-TC-003

List of subcontractors

v2.2 · As of: September 2026

Request document

On request

AMP-TC-004

Privacy Policy

v1.3 · As of: February 2026

Request document

On request

AMP-TC-005

Legal notice (Impressum)

v1.2 · As of: September 2026

Request document

On request

AMP-TC-006

Terms and Conditions

v1.2 · As of: February 2026

Request document

On request

AMP-TC-007

Incident Response Policy

v1.2 · As of: September 2026

Request document

On request

AMP-TC-008

Backup and Recovery Concept

v1.2 · As of: September 2026

Request document

On request

AMP-TC-013

Service Level Agreement (SLA)

v1.0 · As of: February 2026

Request document

On request

AMP-TC-015

AI Usage and Training Data Policy (EU AI Act)

v1.1 · As of: September 2026

Request document

On request

AMP-TC-016

BSI C5:2020 Self-Assessment (SOA)

v1.1 · As of: September 2026

Request document

On request

AMP-TC-017

Transfer Impact Assessment (Schrems II)

v1.1 · As of: September 2026

Request document

On request

AMP-TC-018

NIS-2 Readiness Statement

v1.1 · As of: September 2026

Request document

On request

AMP-TC-019

EU AI Act Declaration of Conformity

v1.1 · As of: September 2026

Request document

On request

AMP-TC-020

SOC 2 Self-Assessment (Trust Services Criteria)

v1.1 · As of: September 2026

Request document

On request

AMP-TC-021

PCI-DSS Non-Applicability Statement

v1.1 · As of: September 2026

Request document

On request

AMP-TC-022

Penetration Testing Policy & Roadmap

v1.1 · As of: September 2026

Request document

On request

AMP-TC-023

ISO/IEC 27001:2022 Implementation Report

v1.1 · As of: September 2026

Request document

On request

AMP-TC-010

Access Control Policy

v1.1 · As of: June 2026

Request document

On request

AMP-TC-024

Information Security Policy (ISMS Master)

v1.1 · As of: September 2026

Request document

On request

AMP-TC-025

Record of Processing Activities (RoPA, Art. 30 GDPR)

v1.1 · As of: September 2026

Request document

On request

AMP-TC-026

Data Retention & Deletion Concept

v1.1 · As of: September 2026

Request document

On request

AMP-TC-027

Vendor & Third-Party Management Policy

v1.1 · As of: September 2026

Request document

On request

AMP-TC-028

Business Continuity & Disaster Recovery Plan

v1.1 · As of: September 2026

Request document

On request

AMP-TC-029

Risk Assessment & Management Policy

v1.1 · As of: September 2026

Request document

On request

AMP-TC-030

Supply Chain Security & SBOM Statement

v1.1 · As of: September 2026

Request document

Subcontractors

Transparent. Complete. Up to date.

Download subcontractor list

Complete list of all subcontractors pursuant to Art. 28 (2) GDPR – broken down by infrastructure, AI inference, sales tooling and tracking. Third-country transfers exclusively on the basis of EU Standard Contractual Clauses 2021/914 including a documented Transfer Impact Assessment (Schrems II, AMP-TC-017).

A. Infrastructure, Platform & Collaboration

Core infrastructure of the customer application on Render Frankfurt and Amazon S3 eu-central-1; the marketing website is technically separated.

| Provider | Purpose | Location | Third-country safeguards | | --- | --- | --- | --- | | Render Services, Inc. | Rails 8 application, PostgreSQL, Redis and background workers | Frankfurt am Main, DE | EU region · Provider evidence on request | | Amazon Web Services EMEA SARL | S3 object storage | eu-central-1, Frankfurt | EU region · Provider evidence on request | | Cloudflare, Inc. | CDN, WAF, DDoS protection | Global Edge / US HQ | EU SCCs + TIA · ISO 27001, SOC 2 | | Vercel / Lovable Hosting (Frontend) | Static hosting of the marketing site | EU Edge | EU internal · SOC 2 Type II | | GitHub, Inc. | Source code, CI/CD (no customer data) | US (private repos) | EU SCCs + TIA · SOC 1/2, ISO 27001 | | Resend, Inc. | Transactional email delivery | EU (Frankfurt) | EU internal · SOC 2 Type II | | Cal.com, Inc. | Appointment booking for initial meetings | EU | EU internal · SOC 2 in preparation | | Google Workspace / Microsoft 365 | Sending and retrieving replies via customer-owned mailboxes via Gmail API / Microsoft Graph | Customer-side region | OAuth access · no stored mailbox passwords |

Render Services, Inc.

PurposeRails 8 application, PostgreSQL, Redis and background workers

LocationFrankfurt am Main, DE

SafeguardEU region · Provider evidence on request

Amazon Web Services EMEA SARL

PurposeS3 object storage

Locationeu-central-1, Frankfurt

SafeguardEU region · Provider evidence on request

Cloudflare, Inc.

PurposeCDN, WAF, DDoS protection

LocationGlobal Edge / US HQ

SafeguardEU SCCs + TIA · ISO 27001, SOC 2

Vercel / Lovable Hosting (Frontend)

PurposeStatic hosting of the marketing site

LocationEU Edge

SafeguardEU internal · SOC 2 Type II

GitHub, Inc.

PurposeSource code, CI/CD (no customer data)

LocationUS (private repos)

SafeguardEU SCCs + TIA · SOC 1/2, ISO 27001

Resend, Inc.

PurposeTransactional email delivery

LocationEU (Frankfurt)

SafeguardEU internal · SOC 2 Type II

Cal.com, Inc.

PurposeAppointment booking for initial meetings

LocationEU

SafeguardEU internal · SOC 2 in preparation

Google Workspace / Microsoft 365

PurposeSending and retrieving replies via customer-owned mailboxes via Gmail API / Microsoft Graph

LocationCustomer-side region

SafeguardOAuth access · no stored mailbox passwords

B. LLM & AI Inference

AI providers are selected according to data minimisation, training exclusion and appropriate retention conditions (see AMP-TC-015).

| Provider | Purpose | Location | Third-country safeguards | | --- | --- | --- | --- | | OpenAI Ireland Ltd. | LLM inference (GPT) for texts & research | According to current provider region | Transfer and retention conditions according to provider register | | Anthropic PBC | LLM inference (Claude) for complex analyses | According to current provider region | Transfer and retention conditions according to provider register | | Google Ireland Ltd. (Vertex AI / Gemini) | LLM inference (Gemini), structured analyses | According to current provider region | Transfer and retention conditions according to provider register | | Perplexity AI, Inc. | Research LLM for intent signals | US | EU SCCs + TIA · SOC 2 Type II | | HeyGen, Inc. | AI video generation (opt-in) | US | EU SCCs + TIA · SOC 2 Type II |

OpenAI Ireland Ltd.

PurposeLLM inference (GPT) for texts & research

LocationAccording to current provider region

SafeguardTransfer and retention conditions according to provider register

Anthropic PBC

PurposeLLM inference (Claude) for complex analyses

LocationAccording to current provider region

SafeguardTransfer and retention conditions according to provider register

Google Ireland Ltd. (Vertex AI / Gemini)

PurposeLLM inference (Gemini), structured analyses

LocationAccording to current provider region

SafeguardTransfer and retention conditions according to provider register

Perplexity AI, Inc.

PurposeResearch LLM for intent signals

LocationUS

SafeguardEU SCCs + TIA · SOC 2 Type II

HeyGen, Inc.

PurposeAI video generation (opt-in)

LocationUS

SafeguardEU SCCs + TIA · SOC 2 Type II

C. Sales, Data Enrichment & Outreach

Legitimate interest in conjunction with § 7 UWG (Act Against Unfair Competition), whitelist criteria, opt-out mechanics and suppression list (see DPA § 8b).

| Provider | Purpose | Location | Third-country safeguards | | --- | --- | --- | --- | | LinkedIn / Sales Navigator (Microsoft Ireland) | B2B research & outreach via the customer's user account, no scraping | EU / US | EU SCCs + TIA · ISO 27001, SOC 1/2/3 | | Apollo.io, Inc. | B2B contact data & sequencing | US | EU SCCs + TIA + opt-out · SOC 2, ISO 27001 | | Clay Labs, Inc. | Data enrichment & workflow automation | US | EU SCCs + TIA + DPA · SOC 2 Type II | | ZeroBounce / Email Validation Services | Email verification before adoption as a lead | Provider-dependent | According to current provider register | | HubSpot Ireland Ltd. | CRM, contact & pipeline data (customer-side) | EU / US | EU internal (EU data centre) · SOC 2, ISO 27001 | | Firecrawl (Mendable Inc.) | Research of public web pages, no login scraping | US | EU SCCs + TIA · SOC 2 Type II (under audit) |

LinkedIn / Sales Navigator (Microsoft Ireland)

PurposeB2B research & outreach via the customer's user account, no scraping

LocationEU / US

SafeguardEU SCCs + TIA · ISO 27001, SOC 1/2/3

Apollo.io, Inc.

PurposeB2B contact data & sequencing

LocationUS

SafeguardEU SCCs + TIA + opt-out · SOC 2, ISO 27001

Clay Labs, Inc.

PurposeData enrichment & workflow automation

LocationUS

SafeguardEU SCCs + TIA + DPA · SOC 2 Type II

ZeroBounce / Email Validation Services

PurposeEmail verification before adoption as a lead

LocationProvider-dependent

SafeguardAccording to current provider register

HubSpot Ireland Ltd.

PurposeCRM, contact & pipeline data (customer-side)

LocationEU / US

SafeguardEU internal (EU data centre) · SOC 2, ISO 27001

Firecrawl (Mendable Inc.)

PurposeResearch of public web pages, no login scraping

LocationUS

SafeguardEU SCCs + TIA · SOC 2 Type II (under audit)

D. Analytics, Tracking & Reach (only with consent)

Activation exclusively after consent via the cookie banner (Art. 6 (1)(a) GDPR in conjunction with § 25 TDDDG, Consent Mode v2).

| Provider | Purpose | Location | Third-country safeguards | | --- | --- | --- | --- | | Google Ireland Ltd. (GA4 & GTM Server-Side) | Reach & conversion measurement | EU / US | EU SCCs + TIA + consent · ISO 27001, SOC 1/2/3 | | Meta Platforms Ireland Ltd. | Conversion tracking (Pixel / CAPI) | EU / US | EU SCCs + TIA + consent · ISO 27001, SOC 2 | | LinkedIn Insight Tag (Microsoft Ireland) | Conversion tracking & retargeting | EU / US | EU SCCs + TIA + consent · ISO 27001, SOC 2 | | Buffer, Inc. | Social media publishing & scheduling | US | EU SCCs + TIA · SOC 2 Type II |

Google Ireland Ltd. (GA4 & GTM Server-Side)

PurposeReach & conversion measurement

LocationEU / US

SafeguardEU SCCs + TIA + consent · ISO 27001, SOC 1/2/3

Meta Platforms Ireland Ltd.

PurposeConversion tracking (Pixel / CAPI)

LocationEU / US

SafeguardEU SCCs + TIA + consent · ISO 27001, SOC 2

LinkedIn Insight Tag (Microsoft Ireland)

PurposeConversion tracking & retargeting

LocationEU / US

SafeguardEU SCCs + TIA + consent · ISO 27001, SOC 2

Buffer, Inc.

PurposeSocial media publishing & scheduling

LocationUS

SafeguardEU SCCs + TIA · SOC 2 Type II

Changes to this list will be communicated to clients at least 30 days in advance (Art. 28 (4) GDPR). Full TIA assessments and certificates per provider available on request (AMP-TC-003, AMP-TC-017).

Security highlights

Confidentiality. Integrity. Availability.

Confidentiality

• Tokens and API credentials protected with AES-256-GCM
• Email 2FA for administrators
• Role-based access according to least privilege
• Logical separation: every record is assigned to one organisation

Integrity

• TLS for data transmissions
• API keys stored exclusively as SHA-256 hashes
• HMAC-SHA256-signed, replay-protected webhooks
• Audit trails for security-relevant actions

Availability

• Production application on Render in Frankfurt
• PostgreSQL, Redis, S3 object storage and background workers as separate components
• Configurable human-review gates before sending
• Suppression and unsubscribe checks before campaign processing

Incident Response

Clear reporting channels in an emergency.

Report a security incident

We accept vulnerabilities, suspected cases and responsible-disclosure reports at any time at:

security@amplifa.ai

Reporting channels & deadlines

• Notification to the supervisory authority within 72 hours (Art. 33 GDPR)
• Information to affected clients within 24 hours
• Documented incident lifecycle with severity classification P1 – P4

FAQ

For procurement & data protection officers.

Where is our data hosted?

The production customer application runs on Render in Frankfurt am Main. Object data is stored in Amazon S3 in the eu-central-1 region. Further providers are documented in AMP-TC-003.

Does amplifa conclude a DPA with us?

Does data leave the EU?

How quickly will we be informed in the event of an incident?

What data does amplifa process?

Can we audit amplifa?

What happens to our data after the contract ends?

Contact

Security questions? Talk to us.

We typically answer security questionnaires and privacy reviews within 24 hours.

Schedule a call Request documents