Application data in the EU: Frankfurt am Main
Trust Center
The answers, before you have to ask.
We sell training that helps our customers answer supplier questionnaires. So the questionnaire about us should not wait for a request. Everything that matters is on this page, including what we cannot show.
Where the data lives
Application data in Frankfurt. Operated from Berlin.
The whole path, not the short version: what stays in the EU is listed here, and what leaves it, too.
Frankfurt am Main, AWS region eu-central-1. User accounts, learning records, certificates and uploaded files live there: encrypted at rest, TLS in transit.
The application is delivered through a global CDN. Connection data arises at the location closest to the visitor: content and accounts stay in Frankfurt.
A German company based in Berlin, so German and European law applies directly, not through an intermediate entity.
For your learners’ data we act as processor. The Art. 28 GDPR agreement forms part of the main contract: readable in full on this site, signed inside the account.
Sub-processors
Who besides us can reach the data.
First those that touch your learners’ data. The line your questionnaire is aiming at.
| Provider | Purpose | Place of processing | Third-country safeguard |
|---|---|---|---|
| SupabaseSupabase, Inc. (USA) Privacy ↗ | Database, authentication, file storage — the core of the platform. | Frankfurt am Main (AWS eu-central-1), EU | Processing takes place in the EU; as the provider is a US company, EU Standard Contractual Clauses apply in addition. |
| CloudflareCloudflare, Inc. (USA) Privacy ↗ | Application delivery, protection against automated access, server logs. | Worldwide, at the location closest to the visitor | Adequacy decision, EU-US Data Privacy Framework (Cloudflare is certified). |
| BrevoBrevo GmbH, Berlin Privacy ↗ | Delivery of platform and marketing email. | European Union | Stays in the EU |
| OpenAIOpenAI Ireland Ltd., Irland Privacy ↗ | AI assistant and dashboard copilot — optional, read-only in the dashboard. | Ireland; onward transfer to the US possible | EU Standard Contractual Clauses; model outputs are not stored as retrievable resources (store=false). |
| GoogleGoogle Ireland Ltd., Irland Privacy ↗ | Gemini API: creating and translating course content, AI functions in the dashboard and fallback model for evaluating feedback (free texts without real names, attributed via pseudonyms). | Ireland; processing in third countries possible | EU Standard Contractual Clauses; no use for advertising or model training. |
| AnthropicAnthropic PBC (USA) Privacy ↗ | Language model for evaluating feedback on course content (free texts without real names, attributed via pseudonyms) and — only with the phishing simulation activated — for template texts. | United States | EU Standard Contractual Clauses and EU-US Data Privacy Framework; no training on customer data. |
The AI services we use to produce voices, images and videos for course content are not sub-processors: they receive narration texts and image descriptions only, none of your learners’ data, no account or progress data, and do not use them for training.
Our own service providers: under our own responsibility
Here we do not act on your behalf: payment, reviews, our own sales. Contract, payment or prospect data flows, none of your learners’ data. The one point of contact is ProvenExpert: name and email address go there when a person clicks the review link at the end of a course themselves, never automatically.
| Provider | Purpose | Place of processing | Third-country safeguard |
|---|---|---|---|
| ProvenExpertExpert Systems AG, Berlin Privacy ↗ | Review platform — name and email address only when a person actively clicks the review link at the end of a course; under our own responsibility, not on behalf of customers. | Germany | Stays in the EU |
| StripeStripe Payments Europe, Ltd., Irland Privacy ↗ | Payment processing and invoicing — contract and payment data of the customer organisation. | European Union; onward transfer to the US possible | EU Standard Contractual Clauses or adequacy decision. |
| InstantlyInstantly.ai (USA) Privacy ↗ | Delivery of cold-outreach email from our sending domains. | United States | EU Standard Contractual Clauses. |
| HubSpotHubSpot Ireland Limited (Irland) Privacy ↗ | CRM for prospect and sales contacts. | European Union (EU data residency) | Stays in the EU |
We announce new sub-processors before they are used; the right to object is set out in the data processing agreement.
Access
The boundary sits in the server, not in the interface.
A hidden button is not access control. Four layers, each holding on its own:
Every table holding personal data has row-level security. A query that would touch another organisation’s data returns no row: regardless of what the application asks for.
Administrative areas require TOTP. This is enforced server-side through the session assurance level (AAL2), not only in the browser.
Areas a role may not use are never loaded. They appear neither in the navigation nor in the JavaScript delivered to that session.
Each organisation is its own tenant. Memberships, assignments, completions and files belong to that organisation, not to a shared pool.
Evidence
What you can export without asking us.
One per completion, with date, course content and pass mark. The three things an auditor asks for.
The complete training record as a file, one click. No ticket, no waiting, no surcharge.
Every legal statement in a course carries its citation to the official text. Verifiable without taking our word for it.
Deletion & retention
The way out is as wide as the way in.
The org admin starts the deletion and confirms it through a link valid for 60 minutes. Account, memberships, assignments and files are then removed.
When someone leaves, the linked personal data is removed. Whatever must be retained as evidence is named in the data processing agreement rather than silently kept.
Export first. The audit export stays available until the end. After that we delete according to the periods set out in the data processing agreement.
In coaching courses for adults, exercise answers and the journal can be stored in the person’s account. Only the person can see them, no org admin, no coach, no support. We delete them 12 months after the last activity in the course, immediately when the assignment is withdrawn, and with the account; when the person leaves the organisation, they stay in the person’s account, independently of the organisation. In courses for minors everything stays on the device.
Operations
How the platform runs, and how we change it.
Every change passes type checks, automated tests and a separate staging environment before it reaches production. Production is not touched by hand.
Daily database backups with seven days of retention; a restore runs at the provider and makes the application unavailable while it lasts. The contractual upper bound: deleted data is gone from all backups after 35 days at the latest (data processing agreement, § 11). Seven days is how we run today, 35 days is the commitment. Point-in-time recovery is currently NOT enabled; if you need minute-level restore, tell us before signing and we will add it.
Maintenance windows are announced. What counts as downtime and what does not is defined in the terms, not in marketing copy.
Your questionnaire
The nine questions, already answered.
Copy these straight into the form. Every answer links back to the section on this page that carries the detail.
In the European Union: Frankfurt am Main, AWS eu-central-1. Encrypted at rest, TLS in transit.
Yes. An Art. 28 GDPR agreement, part of the contract and available in the account. Ask us and we will send it before you sign anything.
The full list is on this page, split into those that touch learner data and those that never do.
Row-level security in the database, TOTP enforced server-side for admin roles, per-organisation tenant separation, and role gating that never ships unauthorised code to a session.
Certificates with date, content and pass mark, plus a one-click audit export of the complete record.
Your admin starts it and confirms through a 60-minute link. No support ticket, no negotiation.
No. We hold neither today, and we would rather say so than imply otherwise: see “What we do not have” below.
security@conformbase.com, also published in our security.txt. Personal-data incidents follow Art. 33/34 GDPR.
Reporting
If you find something.
The same address is published in our security.txt. We confirm receipt and come back with an assessment, including when the finding turns out to be none.
security@conformbase.comWe report personal-data breaches under Art. 33/34 GDPR, to the supervisory authority within 72 hours and to you as controller without undue delay.
Access, rectification, erasure. If a request concerns data we process on behalf of a customer organisation, we forward it to them.
privacy@conformbase.comHonesty
What we do not have.
A trust center that shows only strengths is an advertisement. These four are missing: ask about them if they are decisive for you.
- No ISO 27001 certification and no SOC 2 report. We teach ISO 27001; we are not certified against it. Those are two different statements.
- No external penetration-test report. What we do have are automated tests and the access boundaries described above.
- No public status page with an availability history.
- No Germany-only data residency: delivery runs through a global CDN, and several processors are US companies or process outside the EU. Where, and under which safeguard, is listed per processor in the table above.
Memberships
Teachlume GmbH i.G., the company behind ConformBase, is a member of the German Startup Association (Startup-Verband, Bundesverband Deutsche Startups e.V.).
Documents
To read and to forward.
The operating company is Teachlume GmbH i.G., Friedrichstraße 155, 10117 Berlin. Questions about this page: info@conformbase.com.
Last updated: 2026-10-01