Copyright © 2022-2026 basebox GmbH, all rights reserved.
Licensed to be used in conjunction with basebox, only.
Licensed to be used in conjunction with basebox, only.
// security
GDPR
Applies to
Product: Cloud · Server · Audience: Security / Compliance reviewer · Data protection officers
Roles (controller/processor) per deployment model, availability of a data processing agreement (DPA), data location, data subject rights and how basebox supports them. Not legal advice – the assessment of your processing lies with you as controller.
Roles per deployment model
| Controller | basebox's role | DPA | |
|---|---|---|---|
| basebox Cloud | Your organization | Processor – basebox operates the infrastructure your data sits on and has technical access | Yes, automatically part of every contract (basebox.ai/en/contract); prerequisite for production (Go-live checklist) |
| basebox Server, self-operated | Your organization | None – basebox has no access, there is no telemetry; basebox processes your data only if you grant basebox access for support | Part of every contract; relevant as soon as basebox gets access (remote maintenance) |
| basebox Server, operated by basebox | Your organization | Processor – the maintenance access technically enables access to personal data | Yes, part of every contract |
| basebox Server in a data center operated by basebox | Your organization | Processor when basebox operates the server; data center by default noris network AG, Munich | Yes, part of every contract |
| basebox Cloud (transition phase until November 2026) | Your organization | Processor, with Hetzner and Google as sub-processors | Yes (basebox.ai/en/contract); Art. 9 data best only after the move (Transition phase) |
Application administration and data sit with you in every model (Shared responsibility). Which sub-processors are involved per product – for the Cloud, its transition phase and Server – is described under Data processing & sub-processors.
Data location
- Cloud: platform and language model run on basebox servers in the data center of noris network AG in Munich-East; the servers are owned and serviced by the hardware partner FAST LTA. Both are on the list of sub-processors. Additional compute, e.g. from STACKIT or Mistral AI in the EU, is added only if the provider is on your list of sub-processors. Backups are kept in a second data center in Germany. basebox GmbH is based in Germany and is not subject to the US CLOUD Act (Infrastructure).
- Cloud in the transition phase until November 2026: until the move, in a shared environment at Hetzner in Nuremberg, logically separated, with AI models from Google Vertex in Frankfurt. Health data and other special categories (Art. 9) are best processed only after the move (Data processing).
- Server: your house or a data center operated by basebox (default: noris network AG, Munich) – the server belongs to exactly one customer, the data sits there and only there.
- External services: web search queries go to Staan.ai in the EU, only the search term, without the person's identity or IP address; basebox has a DPA with Staan, and training is excluded. Connectors reach your own systems. Both are off by default and your decision (External services).
- App with an external model (optional): there is none by default; you decide whether you want one, and your administrator sets it up and releases it only for selected groups. Requests go to Google Vertex in the EU, on request to OpenAI (processing may also take place in the USA). Google and OpenAI are then sub-processors and do not train on the inputs; Google logs them for abuse detection for no longer than 30 days, OpenAI for up to 30 days. As US companies, both are subject to the US CLOUD Act, and access from a third country cannot be ruled out (Model providers).
- Cloud and Server: no third-country transfer by the architecture; a third-country link arises only if you use the app with an external model or enable an external service outside the EU. For the transition phase, until the move: the AI models run at Google Vertex in Frankfurt; as a US company, Google is subject to the US CLOUD Act.
Which data is processed
| Category | Examples | Where |
|---|---|---|
| User master data | Name, e-mail, role, groups | Application and identity database |
| Usage data | Sign-ins, actions, client addresses, tool calls | Audit log |
| Content data | Uploads, knowledge base documents, embeddings – depending on what users enter, potentially special categories (Art. 9) | Databases, media volume |
| Chat history | Users' conversations | Locally in the user's browser, not on the server |
| Conversation content in the audit log | Only at Audit Log Level "High", with a notice in the chat | Audit log |
| Credentials | Per-user connector credentials (write-only), password hashes of local accounts | Application and identity database |
Complete: Storage. Whether special categories are processed depends on your use – with patient data a data protection impact assessment is usually indicated.
Data subject rights
| Right | How basebox supports | What sits with you |
|---|---|---|
| Access (Art. 15) | User management shows master data; audit export delivers usage data per user; users see their chats themselves | Compilation and answer |
| Rectification (Art. 16) | Master data in user management or in the directory (LDAP/SSO) | Execution |
| Erasure (Art. 17) | Delete account, remove documents; chats sit in the user's browser. Audit entries cannot be deleted individually | Process per Deletion; factor in backup rotation |
| Restriction (Art. 18) | Deactivate account | Decision |
| Data portability (Art. 20) | Chat export by the user (Back up chats); audit export CSV | Format and handover |
| Objection (Art. 21) | – | Assessment |
Technical and organizational measures
The TOMs you can describe in your record or DPA annex, with references:
- Access control: roles administrator/user, groups, OIDC/LDAP, API keys (Roles & permissions)
- Tenant separation: Cloud isolated environment per organization (Isolation); Server belongs to exactly one customer
- Transport encryption: HTTPS from outside, TLS across host and zone boundaries, inside the cluster a private network without encryption of its own; storage encryption via encrypted disks (Encryption)
- Logging: audit log with Audit Log Level "Standard" or "High" and retention of 6 months (adjustable by the administrator from 3 to 36 months); notice in the chat (Audit & logging)
- Data minimization: web search without user identity, audit without query text, prompt logging off by default
- Deletability: by users and administrators (Deletion)
- Availability: backups, in the Cloud daily and retained for 7 days (Backup · Backup & restore); basebox does not commit to a minimum availability
- Control of processing on behalf: maintenance access time-limited, approved, logged (Remote maintenance)
- Secure development: security tests before release, four-eyes principle (Infrastructure policy)
Not implemented: no encryption at rest by the application; image signatures in preparation.
Incidents
basebox reports personal data breaches without undue delay after becoming aware of them (Art. 33(2) GDPR); about other security-relevant incidents basebox also informs affected customers without delay (Compliance document); notification of supervisory authorities and data subjects under Art. 33/34 lies with the controller. Data protection questions to basebox: datenschutz@basebox.ai; vulnerabilities: security@basebox.ai.
For the review
- Determine the deployment model and thus basebox's role unambiguously.
- Take the DPA (basebox.ai/en/contract) and the list of sub-processors into your record (Data processing & sub-processors).
- Document policies: Audit Log Level, retention, web search, connectors (Policies).
- Set a usage rule for users (which data may go into basebox, which not into web searches).
- Check for a DPIA if special categories are processed; templates for the DPIA (Cloud, Server) and the record of processing activities are available at basebox.ai/en/security.
Next step: Data processing & sub-processors · ISO 27001