How we protect your data
The key facts for procurement, IT security and data protection officers – verifiable and without seals we cannot prove.
Hosting in Frankfurt
The portal, the database and our content platform run at Amazon Web Services in the Frankfurt am Main data centre (eu-central-1). We additionally deliver the content for your screens through the Amazon CloudFront CDN.
Encryption
Connections only use HTTPS with HSTS. The volumes of the portal and the database are encrypted. We store passwords only as bcrypt hashes, confirmation and reset links only as SHA-256 hashes, and stored credentials for connected services encrypted with AES-256-GCM.
Backups
The volumes of the portal and the database are backed up daily in encrypted form. Backups are kept for about 30 days.
Access and logs
Only accounts with the admin role can reach the admin area. When you change your password, all other sessions end. Application logs contain request IDs instead of e-mail or IP addresses and are deleted after 30 days.
API keys
Every API key has its own per-minute limit; all keys of your account share one daily limit. A revoked key is made unusable and its value deleted.
Data protection
We measure reach without cookies and only set technically necessary cookies. All service providers with seat and region, purposes and retention periods are listed in our privacy policy.
Data processing agreement
Where we process personal data on your behalf (Art. 28 GDPR), we conclude a data processing agreement with you, as our terms provide. Write to info@contboxx.com.
Report a vulnerability
We welcome reports of security vulnerabilities at info@contboxx.com. The contact details are also available machine-readably in our security.txt.
As of 31.10.2026