Separate company areas
Access is assigned to the respective company area and checked against permissions. Customers get access to their wholesaler; team members get suitable roles.
Security
Business data deserves clear rules.
Who may see what? Where do you enter credentials? What stays under your control? Here you will find the essential safeguards — with the locations and periods also stated in the data processing agreement and the terms and conditions.
Protected ERP access
API keys are entered in the logged-in area, verified on the server and stored encrypted with AES-256-GCM. They belong neither in emails nor in public contact forms.
Additional account protection
The admin panel offers two-factor authentication. Access should be granted personally and revoked again when your team changes.
Payment data with Stripe
As soon as the payment function has been activated, you enter your payment methods directly with Stripe, not with us. Invoices and payment management will then be in the logged-in company area.
Where your data is stored
Database, file storage and server functions run in data centres in the EU: Frankfurt, Berlin and Belgium. The login service (Firebase Authentication) runs in data centres in the USA, email delivery with Resend, Inc. in the USA — each safeguarded by the EU-US Data Privacy Framework. An older storage location in the USA still holds legacy images and will be deleted after the move. Our infrastructure providers are Google (Google Ireland Limited, parent company Google LLC, USA), Resend, Inc. (USA) and Cloudflare, Inc. (USA); they are therefore also subject to US law. Protection against unlawful access by authorities outside the EU is provided by encryption in transit and at rest, the additional encryption of your ERP keys with our own key (AES-256-GCM), the database in the EU, and the standard contractual clauses and the EU-US Data Privacy Framework with these providers. We only disclose data to authorities where we are legally obliged to do so, and we inform you where this is permitted.
Backups with fixed periods
The database is backed up daily and kept for 14 days, and additionally weekly, for 14 weeks (98 days). On top of that, the state at any point in time within the last seven days can be restored. We back up the login accounts daily, encrypted, in Frankfurt, for 14 days. Older file versions are kept: item images, logos and other files for up to 30 days, signatures and delivery photos for up to 400 days.
Restore tested
A backup only helps if it can be restored. On 10 October 2026 we restored a database backup in full into a separate replacement database and checked the result by counts and a sample. For login accounts and file storage, restoring has so far only been tested in a test environment. We repeat the test every quarter.
Your data to take with you
You can download your data yourself at any time in the admin panel, in a common, machine-readable format — even for thirty days after the contract ends. We charge nothing for switching to another provider.
For incidents there is a written emergency handbook and an emergency brake that lets us stop email delivery and the public forms without a new release. Technical safeguards are no guarantee of complete protection against outages or attacks. Report suspicious access or lost account access via the contact route. A change of owner requires a check of authorisation.
Make your product range
orderable today.
Sign up in two minutes, activated within one working day. 14 days free, no credit card – the trial ends on its own.