Licensed to be used in conjunction with basebox, only.
// security
Infrastructure
Applies to
Product: Cloud · Audience: Security / Compliance reviewer
Which infrastructure the Cloud runs on and who is involved. In short: basebox Cloud runs on servers of the hardware partner FAST LTA in the data center of noris network AG in Munich-East. Platform and language model run on these servers. basebox operates them and is your processor; noris network AG and FAST LTA are on the list of sub-processors (Data processing & sub-processors).
basebox Cloud (transition phase until November 2026)
Until the move, accounts created before the Cloud launch run in a shared environment at Hetzner in Nuremberg, logically separated, with shared user management and AI models from Google Vertex in Frankfurt. basebox moves them. Health data and other special categories (Art. 9 GDPR) are best processed only after the move (Transition phase).
The setup
| Layer | What | Where / by whom |
|---|---|---|
| Hardware | FAST LTA server | Owned and serviced by FAST LTA; sub-processor |
| Location | Data center, power, connectivity | noris network AG, Munich-East – sub-processor |
| Operating system, Kubernetes | Hardening, patching, updates | basebox |
| basebox platform | frontend, AISRV, storesrv, Keycloak, PostgreSQL (CloudNativePG), ingress/TLS | basebox, on the server |
| Service models | ragsrv, ragsrv-support, OCR, speech-to-text | basebox, on the server |
| Language model (inference) | Local on the server | basebox, on the same server |
| Connector services | Calculator, web search, e-mail, others by arrangement | basebox provides; you configure |
| Application | Organization, users, apps, knowledge bases, policies, audit | You |
Several customer organizations share this server, each in an isolated environment (Isolation). The components and their communication paths are the same as on basebox Server – basebox components.
What this means for the assessment
- Language model in the same data center. The AI model runs on the Cloud's servers together with the platform; customers share it, a model just for your organization is available on request. For additional compute, providers such as STACKIT or Mistral AI in the EU or a provider you choose can be added – as sub-processors on your list (Model providers).
- No hyperscaler in the chain. noris network AG provides space, power and connectivity, FAST LTA hardware and servicing; both are sub-processors. Third-country questions arise only from services you enable yourself – web search provider, connector target systems and the app with an external model (Google Vertex in Frankfurt; as a US company, Google is subject to the US CLOUD Act). basebox itself, as a German company, is not subject to the US CLOUD Act.
- Processor with a DPA. basebox operates the servers and processes as a processor; the DPA is part of every contract (basebox.ai/en/contract), the sub-processors are in the PDF list.
- Third parties have physical access. The data center staff and FAST LTA, which owns and services the servers, have physical access; both are on the list of sub-processors. Stored data is protected by encrypted disks; basebox provides the details on request (Encryption).
- Same software as Server. Security properties of the application – role model, connector gate, audit log, web search controls – are identical.
What basebox tells you
For contract negotiation, as far as not yet answered here:
- Certifications of the Noris data center and its physical access controls
- Redundancy of power, cooling and network
- Network architecture between customer environments (Isolation)
- Fixed egress addresses of the Cloud for your firewall (Network connectivity)
Contact: datenschutz@basebox.ai.
Operation
basebox applies updates; changes are under Versions. basebox applies urgent security updates outside the maintenance window as well; in case of known systemic risks or security-relevant incidents basebox informs affected customers without delay (Compliance document). Before every release the software goes through static code analysis, dependency scan, CVE check, unit tests, test installation and manual QA (Infrastructure policy). basebox monitors the environment technically, analyses logs for unusual events and logs administrative access to the infrastructure.
basebox does not commit to a minimum availability. Support is available on working days from 9:00 to 17:00 by e-mail or ticket system, with a first response within one working day, prioritized by severity. basebox offers further service levels on request. The appendix "Support and service levels" of your contract is authoritative.
Next step: Administrative access