Data stays in Germany.
Naturalization is a highly sensitive administrative procedure. We handle the resulting data accordingly — with a clear DSGVO architecture, hosting exclusively in Germany, and transparent sub-processors.
Hosting & architecture.
The entire civitas. platform runs on servers in Germany. No data traffic outside the EU, no sub-processors headquartered in third countries for core data — and an architecture designed to be multi-tenant (mandantenfähig) so that every authority and every institutional partner receives its own, isolated data space.
Encryption.
Encryption takes place both in transit and at rest. Sensitive application data is additionally encrypted at the application layer, so that even access to the database without the application key reveals no readable personal data.
Subprozessoren (subprocessors).
civitas. uses selected service providers for clearly delimited tasks. All sub-processors are contractually bound by the DSGVO, with AVV under Art. 28 DSGVO. The location is transparently documented — where possible, providers with their headquarters and data processing in the EU are preferred.
The list is updated when changes occur. Authorities and institutional partners are informed of material changes to the sub-processor register. A complete sub-processor catalog is part of the AVV (data processing agreement).
Auftragsverarbeitung (data processing on behalf).
When civitas. processes data for institutional partners (Behörden, law firms, counseling centers), this happens exclusively on the basis of an Auftragsverarbeitungsvertrag (data processing agreement) under Art. 28 DSGVO. The AVV automatically becomes part of the license agreement and is available in standardized form.
The AVV (data processing agreement) is designed for institutional clients (authorities, law firms, counseling centers). For private customers who use civitas. themselves, civitas. is the controller under Art. 4 Nr. 7 DSGVO — here the Privacy Policy applies, not an AVV.
Data subject rights.
Applicants and all other affected persons may exercise their rights under the DSGVO towards civitas. at any time. We process requests within the statutory one-month deadline pursuant to Art. 12 Abs. 3 DSGVO.
Incident response.
Security incidents are handled according to a clearly documented process — with defined Eskalationsstufen (escalation levels), notification deadlines, and subsequent Ursachenanalyse (root cause analysis). In the event of a Verletzung des Schutzes personenbezogener Daten (personal data breach), notification to the Aufsichtsbehörde (supervisory authority) under Art. 33 DSGVO is made within 72 hours.
Procedure for security incidents.
From detection of an incident to restoration of regular operation, we follow a standardized process. Clients and affected parties are informed as early as possible, transparently and traceably.
Compliance.
An honest status: which standards we meet today, which certifications are currently in progress, and which are planned for 2026/2027. We communicate this transparently rather than performing compliance theatre.
Direct contact for security and Data protection.
For security reports, data protection enquiries, audit requests or specific questions about our architecture. In the event of suspected security vulnerabilities, we ask for confidential reporting — we confirm receipt within 24 hours.