Trust & security
Your data, your SAP system, your auditors — accounted for.
What we do, in the order your security review will ask. The documents behind each point — certificates, architecture diagrams, data-processing terms — are available under NDA.
- Hosting
- EU · dedicated environment per customer (AWS or OVHcloud DE)
- Backups
- Daily, encrypted, Frankfurt · 21/42-day retention
- Connectivity
- IPsec site-to-site or extract hand-over
- Access
- Named accounts (CAS) · roles · four-eyes · EEA staff
- Encryption
- TLS in transit · backups and credentials encrypted
- AI
- Bedrock EU · provider retention none · functions off by default
- SAP writes
- BAPI · IDoc · OData/RAP · Migration Cockpit — never direct
- Certified
- ISO/IEC 27001 · ISO 9001
Fact sheetDetails under NDA
01
Six areas, in the order you will ask.
01Hosting and isolation
- Hosted in the EU: a dedicated environment per customer, on AWS or on a dedicated server at OVHcloud (Germany), operated by Visehub only
- Nothing shared between customers: own containers, database and storage; services reachable only through an edge proxy with an allow-list of your addresses
- Connection to your systems through a site-to-site IPsec tunnel limited to the agreed subnet — or an extract hand-over if you prefer no connection
- All personnel work from within the EEA (Poland); administrative access by named engineers with key-based SSH only
02Access control
- Named accounts only, through Visehub’s central sign-on (CAS); roles scoped per programme, project and site
- Approvals and sign-offs carry the user and the time; four-eyes approval for changes that reach a target system
- Settings that change what leaves your environment (AI switches, provider configuration) are held by Visehub superusers, never by a customer admin role
03Data protection
- Encryption in transit: TLS for every application, API and AI call; IPsec to your network. Backups encrypted on the host before they leave it; stored credentials encrypted at field level
- Daily backups to Amazon S3 in Frankfurt (eu-central-1): 21 days daily, 42 days weekly, write-once protected for 14 days; monthly automated restore drill; recovery point 24 hours
- Data-processing agreement under Art. 28 GDPR with the list of sub-processors; deletion within 30 days of the end of the service, backups expire on schedule
- Personal-data breach: notification to you without undue delay, where practicable within 48 hours
04AI functions
- AI runs on Amazon Bedrock in EU regions only, called from the backend; model-invocation logging off and provider data retention set to none — prompts and outputs are not stored by the provider and never used for training
- Every AI function is switched off on a new installation and switched on one by one on your decision; one kill switch disables them all
- Requests carry metadata, profile statistics and value shapes — never records, never personal data, never tax, bank or identity values; a payload preview shows the exact request before anything is sent
- An evidence trail per AI call (who, what, which columns, prompt hash — never the text) kept 365 days and exportable; bring-your-own AWS account on request
05Integrity of the target system
- Loads only through standard SAP interfaces (BAPI, IDoc, OData/RAP) or Migration Cockpit
- Never a direct database write; SAP validation, CVI, number ranges and change documents stay active
- Load simulation before every load; errors to a correction queue, not into production
06Auditability and management systems
- Every validation run, transformation, value change and merge decision recorded with user, time and rule; versioned rules, mappings and dictionaries
- Changes to the application stack and to AI configuration are released from source through a CI pipeline with automated tests; every release is tagged
- ISO/IEC 27001 (information security) and ISO 9001 (quality); certificates and the current Statement of Applicability under NDA
02
What we hand over under NDA.
The review usually needs the paper behind the statements above. Ask for it on the first call; nothing here requires a signed contract.
- 01 ISO certificates ISO/IEC 27001 and ISO 9001 certificates with scope and validity, and the current Statement of Applicability.
- 02 Architecture Hosting and network diagrams: the dedicated environment per customer (AWS or OVHcloud, EU), the IPsec tunnel, backups in Frankfurt, where data rests and for how long.
- 03 Data processing Our data-processing agreement (Art. 28 GDPR) with the technical and organisational measures, the sub-processor list (hosting, backups, Amazon Bedrock) and the AI data boundary, function by function.
- 04 SAP interface note Which standard interfaces each object uses and why there is no direct database write — for your SAP architect.
Security questionnaire to fill in?
Send it over. We answer every line ourselves — the people who run the platform, not a template.