Trust is the foundation,
not a feature.

Fiscova acts as a data processor within the meaning of Art. 28 GDPR. We conclude a data processing agreement (DPA) with every firm before any production data is processed.

As client data is subject to professional secrecy under § 203 StGB, we treat all content as protected professional data. Employees and subprocessors are contractually bound to maintain professional secrecy (§ 203 para. 4 StGB, § 62a StBerG).

The production environment runs in the Hetzner data centre in Nuremberg. All client data remains within the EU.

Core data (call recordings, transcripts, email content, file data) remains within the EU. Where subprocessors are involved in processing core data, they are contractually bound pursuant to Art. 28 GDPR; any third-country transfers take place exclusively on the basis of EU standard contractual clauses or DPF certification. AI models are accessed via EU endpoints (see Section 04).

• TLS 1.3 for every inbound and outbound connection.
• AES-256 encryption for data at rest in the database and filesystem.
• Object storage (attachments, audio files) is additionally encrypted server-side.
• Key rotation and a separate key management key hierarchy.

Client data is never used to train AI models — neither by Fiscova nor by the underlying model providers. This commitment is contractually fixed in the agreements with our AI service providers (AWS Bedrock, Deepslate) ("Zero Data Retention").

Technically enforced: AI models are accessed exclusively via dedicated EU endpoints. Inputs and outputs are not persisted.

Fiscova drafts, classifies and proposes — a person reviews and approves. There is no automated outbound communication without the explicit approval of an authorised person at the firm.

Every automated action (call handling, email draft, DATEV handover) is recorded in an immutable audit log. Logs are retrievable in audit-proof form for 12 months.

We use the WhatsApp Business Cloud API with Meta Ireland as EU controller. Content is additionally mirrored in our Nuremberg infrastructure and treated in accordance with the requirements of § 203 StGB.

Clients are informed about the communication channel before first use. Incoming messages arrive immediately in the firm's Fiscova inbox and are subject to the same retention and deletion obligations as email or phone.

• Single Sign-On (SSO) via Microsoft 365 / Entra ID.
• Mandatory MFA for administrative roles, optional for all users.
• Granular role and permission models per client, channel and function.
• Session lifetime and IP allow-listing configurable.

• Daily encrypted backups of the production database.
• 30-day retention; geographically separate backup target within Germany.
• Recovery Time Objective (RTO) < 4 hours.
• Quarterly recovery tests.

We announce any change to the subprocessor list at least four weeks in advance. Firms may object to a change in writing on material data protection grounds.

As of 9 June 2026

For the public website (without client data) we additionally use Vercel (hosting), Supabase (forms) and HubSpot (CRM) — details in the privacy policy.

• ISO 27001 in preparation (audit roadmap available on request).
• Alignment with BSI IT-Grundschutz compendium.
• GDPR- and § 203-compliant integration with firm software (DATEV, ADDISON, Simba, Agenda).
• Penetration tests by an external security firm at least annually.

For enquiries regarding data protection, data processing and data subject rights, please contact us at:

Data Protection Contact

Tobias Wedel

Email

datenschutz@fiscova.de

Postal address

Fiscova GmbHDonaustraße 4412043 Berlin