Security and data protection in software development
When you commission software, you entrust your provider with business data, source code and often personal data. This page answers the questions companies ask us most often: Where is the data stored? Who has access? Can we get a data processing agreement? We describe only what we actually do. No badges and no promises we cannot back up.
- Frankfurt
- Data centre in Germany
- Art. 28
- DPA on request
- TLS
- Encrypted transport
- NDA
- Before project start on request
Hosting in Germany: data centre in Frankfurt am Main
Our servers are located in a data centre in Frankfurt am Main. They run this website, our internal admin system and, if you hand operation over to us, your application and its database. Your data is therefore stored in Germany.
If you prefer to run your software in your own infrastructure, such as your own data centre or your AWS or Azure account, we set it up there. You then decide on the location; for personal data we recommend a region within the EU.
For context: our development team works from Baku, Azerbaijan. The data stays in Frankfurt. Whether and how far we access it remotely is agreed with you before the project starts.
Data processing agreement (DPA) under Art. 28 GDPR
As soon as we process personal data on your behalf, we sign a data processing agreement under Art. 28 GDPR with you (in Germany: Auftragsverarbeitungsvertrag, AVV). In software development this typically covers:
- Operating an ERP system for you, e.g. KartonERP for corrugated board plants
- Hosting your application on our servers in Frankfurt
- Support and troubleshooting with access to production data
- Migrating data from a legacy system into the new software
How the DPA is concluded
We send you our DPA template on request in advance so that your data protection officer can review it at leisure. If your company uses its own template, we are happy to review that instead. The agreement sets out which data is processed for what purpose, who may access it and which technical and organisational measures apply.
If, on the other hand, we only work with test data and have no access to your production systems, there is often no data processing on your behalf at all. We clarify which case applies to your project in the initial consultation.
Access control: who has access to your data?
Only the team members working directly on your project get access to your systems, and only as far as their task requires. This principle of least privilege applies to people as well as to services and database users.
Our own admin system, which we use to manage enquiries, projects and the content of this website, shows how we put this into practice:
- Four roles
- Owner, administrator, editor and read-only. Deleting records and managing users are reserved for owners and administrators.
- Hashed passwords
- Passwords are never stored in plain text, only as bcrypt hashes.
- Token-based sessions
- After sign-in the browser receives a signed, time-limited token. Every API request is checked against this token and the user's role.
Secure development: what GDPR-compliant software development means to us
Data protection cannot be bolted on afterwards. That is why these principles are part of our normal workflow, from the first sprint to handover:
- Separate environments
- Test and production environments are kept separate. New versions are checked in the test environment and shown in the sprint demo before they go live.
- Test data instead of real data
- Wherever possible we develop and test with synthetic data. We use production data only when a task requires it and it has been agreed with you.
- Code review
- Code changes are reviewed by a second developer before they are merged.
- Encrypted transport
- Data between browser, application and interfaces is transmitted over TLS.
- Backups
- We agree the scope and procedure of backups with you for each project.
- Removing access
- At the end of the project, or when someone leaves the team, we remove access to your systems.
Confidentiality: NDA before the project starts
Before you show us business documents, source code or details of your processes, we sign a non-disclosure agreement on request. This is possible even before the requirements analysis, i.e. before you have received a quote.
We use information from your project solely for work on your project.
Data protection on this website
What we recommend for your software, we also apply to our own website:
- No cookies for visitors. The language comes from the address; statistics only with your consent
- Fonts are loaded from our own server, not from third parties
- All traffic is transmitted over HTTPS only
- Enquiries from the contact form are stored in our own database and not passed on to third parties
Contact and reporting security vulnerabilities
Please send questions about data protection, DPAs or NDAs to hello@dcl.az. A German-speaking contact will reply within 24 hours on working days.
If you have found a possible security vulnerability in our website or one of our applications, please also write to hello@dcl.az. The contact details are also available in machine-readable form at /.well-known/security.txt. Please describe where and how the problem occurs, and do not publish details until we have been able to fix it. We are grateful for every responsible report.
Frequently asked questions about security and data protection
Where is our data stored?
If we operate your application, in our data centre in Frankfurt am Main. Alternatively we set up the software in your own infrastructure or cloud account. Then you decide the location.
Do you sign a data processing agreement?
Yes. As soon as we process personal data on your behalf, for example when operating an ERP system, hosting, or supporting you with production data, we sign a DPA under Art. 28 GDPR. We send you our template on request in advance.
Who on your team has access to our data?
Only the people working directly on your project, and only to the extent of their task. Where we process data on your behalf, who has access is recorded in the DPA. At the end of the project we remove access.
Is data processed outside the EU?
The data is stored in Frankfurt. Our team, however, works from Baku, and remote access to personal data can count as a transfer to a third country under data protection law. That is why we work with test data wherever possible and agree with you before the project starts whether and how access to real data is needed.
Will you sign an NDA before we send details?
Yes, on request we sign a non-disclosure agreement before the project starts, even before the requirements analysis. You are welcome to send us your own template.
Do you work with our real customer data?
Not wherever it can be avoided. We develop and test with synthetic data in a separate test environment. We use real data only when a task requires it, e.g. a data migration or troubleshooting, and only after agreeing it with you.
How do I report a security vulnerability?
Write to hello@dcl.az. The contact details are also at /.well-known/security.txt. Please describe the problem as precisely as possible and do not publish details until it has been fixed.
Questions about data protection or a DPA?
In a free 30-minute initial consultation we clarify which data your project involves and which agreements make sense. We are happy to send you our DPA template in advance.