Security & GDPR
An overview of how we protect the data you keep in CRM, AI Insights, OMS and Check-in. It is written for the people who need to assess us as a supplier. If you need more detail, or have a security questionnaire to fill in, email info@codefab.dev.
Hosting and data residency
- Our products run on our own platform in Hetzner's data centre in Nuremberg, Germany. Hetzner Online GmbH is a German hosting provider, and its data centres are certified to ISO/IEC 27001.
- Customer data, files and backups are stored in the EU.
- The AI features in CRM and AI Insights use Berget AI, an AI provider based in Sweden.
- The previous version of OMS at codefab.dev/products is still served from a server we operate in Sweden.
Encryption
- In transit: all traffic to our products uses HTTPS (TLS) with automatically renewed certificates, and plain HTTP is redirected to HTTPS.
- Stored credentials: passwords and keys you give us, such as SMTP, SMS-provider and database credentials, are encrypted with AES-GCM before they are stored, and are never shown in full again.
- API keys are stored only as hashes, shown once when they are created, and can be given an expiry date or revoked at any time.
Separation between customers
Every product is multi-tenant, and each customer's data is separated in the database itself using PostgreSQL row-level security. The applications connect with a database role that is subject to these rules and cannot bypass them, so a bug in application code cannot simply return another customer's rows. Each product has its own database and its own database roles.
Sign-in and access control
- Sign-in goes through our own Keycloak identity server at auth.codefab.dev, with a separate realm for each product.
- Two-factor authentication (TOTP) is mandatory for all users of CRM and AI Insights.
- Roles within each account (for example administrator and member) limit what each user can see and do.
- CRM API keys are limited to the scopes you choose and are rate limited.
- AI Insights only runs read-only queries against your databases, and we recommend connecting it with a read-only database user.
- The CRM AI assistant asks for confirmation before it sends or deletes anything, and this is enforced on the server.
Operational security
- Only authorised Code F AB staff have access to production. Server access uses SSH keys and is restricted by a firewall.
- Secrets such as database and API passwords are kept out of source code and stored as access-restricted platform secrets.
- Each product uses its own database owner role without superuser rights, following the principle of least privilege.
- Administrative and data-affecting actions are recorded in audit logs in CRM, AI Insights and Check-in.
- Database changes are applied through versioned, forward-only migrations.
Backups and continuity
All product databases on the platform are backed up every night and backups are kept for 14 days. We plan and announce maintenance in advance and keep it short.
Incident handling
If we discover a security incident, we contain it, investigate it and fix the cause. If personal data is affected, we notify the customers concerned without undue delay, and no later than 48 hours after we become aware of it, so that you can meet your own obligation to notify the authority within 72 hours. We keep a record of incidents and the measures taken.
GDPR
- You are the controller of the data in your account and we are your processor. Our Data Processing Agreement covers the requirements of GDPR Article 28.
- CRM has built-in tools for data subject requests: a full export of a contact's data, erasure, unsubscribe and suppression handling, and automatic retention clean-up.
- You can export your data at any time, and it is deleted when the agreement ends.
- We never use your data for our own purposes, never sell it and never use it to train AI models.
The sub-processors we use to run the products:
| Provider | Purpose | Location | Used by |
|---|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting: servers, databases, file storage and backups | Germany (Nuremberg), EU | All products |
| Berget AI | AI language model that generates assistant replies, queries and summaries. Only the content needed for the request is sent | Sweden, EU | CRM (AI assistant), AI Insights |
| Amazon Web Services (Amazon SES) | Delivery of system emails such as sign-in invitations, password resets and account notifications | Sweden (Stockholm region), EU. AWS is certified under the EU–US Data Privacy Framework | All products |
| Google (Gmail) | Delivery of order and job emails sent from OMS | EU and USA (EU–US Data Privacy Framework and Standard Contractual Clauses) | OMS |
Integrations you can enable yourself, such as SMS or email providers, are listed in the DPA.
Reporting a vulnerability
If you believe you have found a security issue in one of our products, please email info@codefab.dev with the details. We will acknowledge it, investigate it and keep you informed. Please do not access other customers' data or disrupt the service while testing.
Security reviews
We are happy to answer security questionnaires and to walk you through our setup, our sub-processors and the measures above as part of your vendor assessment.