Data Security & Technical Measures

Encryption & Transport

All connections to baduno.com exclusively use TLS-encrypted HTTPS; unencrypted requests are redirected. Passwords in the customer area are never stored in plain text but are stored using a modern, memory-hard procedure (scrypt) with an individual salt; sessions run via HttpOnly-Secure cookies with limited lifespan.

Infrastructure & Access

Operations run in German data centers (Hetzner) with separate system environments. Administrative access is exclusively via key-based SSH connections; password logins are disabled. Access is restricted to named individuals and is logged; permissions follow the principle of least privilege.

Data Backup & Recovery

Daily automated backups with defined retention, regular restoration tests, and documented recovery plans are standard. Before any major intervention – such as migrations – we create additional full backups; recoverability is verified, not assumed.

Handling of customer data in projects

Project data is maintained separately per customer; access is granted only to project participants. External auditors work under a confidentiality agreement and receive only the information necessary for their task. After project completion, we release data as agreed and delete it after statutory retention periods expire.

Vulnerabilities & Incidents

We deploy security updates promptly within planned windows; systems are monitored. If you discover a vulnerability, please report it to [email protected] – we respond quickly, communicate transparently, and expressly refrain from legal action against good-faith reporters. Notifiable data protection incidents are handled in accordance with Art. 33/34 GDPR.

Practical example: A new customer project from registration to data deletion

To make the technical and organizational measures tangible, let us consider a typical scenario: A customer registers for the customer portal at baduno.com. The connection is established exclusively via TLS-encrypted HTTPS; when the page is accessed, it is automatically redirected to the secure version. When entering the password, it is hashed using the memory-hard scrypt algorithm with an individual salt – it is never stored in plaintext. After successful login, a session is established via an HttpOnly Secure cookie with a limited lifespan.

Next, the customer creates a new project. Project data is stored separately from other customers, and access is restricted to the designated project participants. Administrative access to servers occurs exclusively via key-based SSH connections; password logins are disabled, and all access is logged. During the project runtime, automated backups are created daily and tested for restorability. Before major interventions such as migrations, an additional full backup is made and its restorability is verified.

After project completion, the data is handed over to the customer in accordance with the agreement. Statutory retention periods are observed; after they expire, the data is deleted. This process illustrates how the security measures interact in practice and are applied continuously.

Common misconceptions about our security measures

In conversations with customers and partners, we repeatedly encounter misunderstandings that we would like to clarify here:

“TLS alone makes the entire website secure.” – TLS encrypts the transmission between your browser and our server. It protects your data during transport. On the server itself, additional measures such as separate system environments, access restrictions, and password hashing are necessary to also protect the data there. Baduno implements all of these measures.

“Backups are only needed in an emergency.” – Backups are not only used for recovery after an incident. We regularly test recoverability to ensure that the data backup actually works. This is an active process that is documented.

“Passwords are stored securely, but what about sessions?” – Sessions run via HttpOnly-Secure cookies with a limited lifespan. These cookies are protected from access by client-side scripts and are only sent over encrypted connections. Additionally, session data is protected on our server using appropriate methods.

“Security updates are installed immediately.” – We install security updates promptly within planned windows, taking system stability into account. In the case of critical vulnerabilities, unscheduled updates may also occur. This is coordinated and documented.

What our security measures mean for you as a customer

Our technical and organizational measures are designed to protect your data throughout our collaboration. For you as a customer, this means concretely:

You can trust that your project data is kept separate from other customers and that only authorized persons can access it. If you or your data protection officer need evidence of our security precautions, we make this available within the framework of our data processing agreement. The measures described, such as TLS encryption, secure password hashing, and regular backups, are documented and verifiable.

In the customer area, you have the option to securely manage your own access credentials. Use a strong, unique password and keep it confidential. Do not share your access credentials with unauthorized persons. If you discover a security vulnerability, you can report it to us at [email protected] – we handle this transparently and refrain from legal action against good-faith reporters.

Through the interplay of our measures and your cooperation, we create a trustworthy environment for your localization projects. We are available at any time to answer questions about individual measures.

Internal process at our company

At Baduno, the technical and organizational measures (TOM) are brought to life through their consistent application in daily operations. Internally, we have defined who is responsible for which security areas: A designated security officer coordinates implementation, while system administration is responsible for technical configuration and monitoring. Regular internal reviews check whether the measures still meet current requirements and need to be adjusted. We rely on documented processes for this – for example, for assigning access rights, installing security updates, or conducting recovery tests. Any intervention in the infrastructure is planned in advance and carried out according to a defined scheme; changes are logged so that it is always traceable who did what and when. New employees are instructed in the security policies upon joining and sign a confidentiality agreement. External service providers, who are occasionally engaged for maintenance work, are also subject to the same strict access rules and work only under supervision. In this way, we ensure that the described measures not only exist on paper but are lived in everyday practice.

Synergy with Our Other Policies

The security measures on this page are not an isolated toolkit but part of a comprehensive compliance framework that also includes our Privacy Policy and General Terms and Conditions. In the Privacy Policy, we explain which personal data we process, for what purposes, and on what legal basis. The technical measures described here ensure that this processing takes place securely – for example, through encryption, access controls, and separate data storage. Our Terms and Conditions, in turn, govern the contractual obligations of both parties, including the release and deletion of project data after contract termination. For customers in the public sector or with special security requirements, we offer supplementary data processing agreements upon request, which deepen the agreed TOMs. The processes for vulnerability reporting and handling data protection incidents are linked to our general incident response policy. So when you look at our overall compliance landscape, you see that the security measures do not stand alone but form a coherent overall picture with the other documents – from the theory in the Privacy Policy through technical implementation to contractual safeguards.

Terms Clearly Explained

To help you better understand the measures described, we explain here some technical terms used on this page. TLS (Transport Layer Security) is an encryption protocol that protects the connection between your browser and our server – comparable to a sealed envelope for data transmission. HTTPS is the combination of HTTP and TLS; it indicates that the connection is secure. A hash is not a password, but a string mathematically calculated from the input. Unlike an encrypted password, a hash cannot be converted back into the original input. A salt is a random value appended to the password before hashing to prevent identical passwords from producing identical hashes. The scrypt algorithm we use is a memory-hard hashing method that significantly complicates attacks using specialized hardware (ASICs). HttpOnly-Secure-Cookies are small data packets that store the session identifier and cannot be read by scripts – a protection against XSS attacks. Key-based SSH authentication replaces the conventional password with a cryptographic key pair and is considered significantly more secure. These terms help you better assess the technical background of our security measures.

Step-by-Step Practical Example: From Registration to Data Deletion

To make the technical measures even more tangible, we go through the already outlined example of a new customer project in detail again. Each step shows which security precautions are in effect in the background.

Step 1 – Registration and Login: When you register in the customer area, your browser sends the data via a TLS-encrypted HTTPS connection. The password is already hashed on the server using the memory-hard scrypt method and an individual salt – a plain text password never exists at any time. After successful login, an HttpOnly-Secure-Cookie is set, which is only transmitted via HTTPS and cannot be read via JavaScript.

Step 2 – Create project: When creating a new project, the entered data is stored in a separate, multi-tenant database structure. Only the project participants you designate receive access – and only to the areas necessary for them (need-to-know principle).

Step 3 – Ongoing backups: During the project runtime, our system automatically creates daily backups. These are encrypted and stored on separate storage systems. Before any major intervention – such as a data migration – we additionally create a manual full backup and verify its recoverability through a test.

Step 4 – Access controls: Every administrative access to the servers takes place exclusively via key-based SSH connections. Password logins are disabled. All accesses are logged and regularly checked for anomalies.

Step 5 – Project completion and deletion: After project completion, you receive the data in an agreed format. We observe the statutory retention periods – after their expiration, we permanently delete the data from all systems, including backup tapes.

What Our Security Measures Mean for You as a Customer

The technical and organizational measures described on this page are not just a document – they have a direct impact on your daily work with Baduno. Here we summarize what you as a customer will experience in everyday life.

Secure login and sessions: You can rely on your login credentials being protected during transmission and storage. The use of scrypt with salt makes it practically impossible for attackers to crack passwords from a database leak. HttpOnly secure cookies prevent session tokens from being stolen through script attacks.

Protected project data: Your project data is strictly separated from that of other customers. Even in the event of a hypothetical system breach, an attacker could not easily access all customer data. Access restrictions based on the principle of least privilege ensure that only the persons you have designated can see your data – and even then only the portion necessary for their task.

Reliable data backup: Should a technical defect occur, we can restore your data within a short time from daily backups. Regular recovery tests give us the confidence that the backups actually work – we do not rely solely on the existence of backup files.

Transparency in incidents: If, contrary to expectations, a security-relevant incident occurs, we inform you promptly and in accordance with legal requirements. You do not have to worry about reporting obligations yourself – we take care of that for you.

These measures give you a high level of security in daily operations without having to worry about technical details yourself.