What happens to your workforce's health data
Absences, BEM meetings (the return-to-work procedure required by German law) and surveys are special categories of data under Art. 9 GDPR. This page shows where they are stored, who can see them and which service providers are involved – including those outside the EU.
Where the data is stored
- Data centre in Frankfurt am Main
- The platform runs on DigitalOcean in the Frankfurt region (EU). The database – a PostgreSQL database managed by DigitalOcean – and the files you upload are stored there too.
- Payment data stays with Stripe
- Payments are handled by Stripe. Card data is stored there, not with us.
Certificates of the data centre, not of EasyWHP: DigitalOcean lists ISO 27001 and SOC 2 Type II, among others, for its Frankfurt site (FRA1). Source: DigitalOcean, Certification Reports
Who can see what
- Each company sees only its own data
- Every request is checked against the company of the signed-in account. On top of that, the application restricts its database queries to that company. Without that assignment, nothing comes back.
- Roles per function
- Managers set things up and are responsible for HR topics; editors run the day-to-day work. For every function it is defined which role may view or change it. The check happens on the server, not just in the interface.
- Read-only access for management
- Your management can get an account that may only read the management figures – nothing else.
How health data is protected
- Results only from five people upwards
- Surveys and group analyses only show values once at least five people are behind them. Smaller groups are hidden – even where they could otherwise be worked out from the total.
- BEM stays confidential
- E-mails about BEM have a neutral subject line. Reminders to HR contain no case, meeting or measure details – only the recipient's name, a date and the link into the platform.
- BEM content is deleted
- The content of a BEM procedure is deleted three months after it ends, the whole case after three years. In between, only the record of when someone was invited and how they responded remains.
- The AI only sees what you release
- In the AI privacy cockpit you decide, per type of data, what the AI assistant may see. The list of employee names is blocked by default. BEM data is always blocked for the AI and cannot be released.
- Credentials encrypted
- We store the credentials for your HR systems encrypted (AES-256-GCM).
Sign-in and testing
- Sign in with a passkey
- Instead of a password you can sign in with a passkey – using your fingerprint, face recognition or device PIN.
- Rejected sign-ins are logged
- Every rejected sign-in attempt is recorded. If they pile up, we receive an alert e-mail.
- Penetration tests
- We check the platform for vulnerabilities with penetration tests.
- Automated tests before every release
- Before every new version, automated tests check, among other things, that one company cannot reach another company's data.
How HR data gets into the platform
- Direct connection to your HR system
- You connect Personio, rexx, Factorial, Lucca and Kombo directly. Employees and absences then come from your HR system by synchronisation instead of being typed in. Which connections are included depends on your plan.
- Upload a DATEV file
- Without an interface, you upload employees and absences as a DATEV file (the German payroll standard).
- Unknown absences never count as sickness
- If your HR system sends an absence type the platform does not know, it is skipped – never counted as sickness.
Service providers that process data
Not everything runs in Frankfurt. These service providers process data for the platform:
- DigitalOceanHosting, database and files · Frankfurt (EU)
- CloudflareName resolution (DNS) and the encrypted connection for website, app and interface: every request to the platform passes through Cloudflare · USA
- ResendSending the platform's e-mails · USA. The contract with Resend is not intended for special categories of data – which is why BEM e-mails contain no case or meeting content.
- StripePayment processing
- AI providersAI features such as the assistant and translations. Which model answers is set by us as the operator: Flower Labs (Hamburg) and Mistral AI (Paris) in the EU, or OpenAI and Anthropic in the USA. What the AI may see about your workforce is up to you in the AI privacy cockpit. The live voice conversation runs through OpenAI (USA) – only if your company switches it on and confirms the transfer.
We announce new sub-processors four weeks in advance. Connections you switch on yourself – such as Slack or Microsoft Teams – run through the respective provider.
Further reading
Frequently asked questions
Is all data stored in Germany?
The platform, the database and your files are stored in Frankfurt am Main. Some services run outside the EU: traffic to the platform passes through Cloudflare, e-mails are sent by Resend (both USA), and AI features run – depending on the model set – through OpenAI or Anthropic (USA). The list of service providers is further up on this page.
Which certificates and tests are there?
The data centre in Frankfurt is certified – DigitalOcean publishes the certificates for its FRA1 site. We test the platform itself for vulnerabilities with penetration tests.
From how many people does an analysis show values?
From five. Groups with fewer people are hidden. If a hidden group could be worked out from the total, another group is hidden as well.
Does the AI get the names of our employees?
Only if you release them in the AI privacy cockpit. The list of names is blocked by default. BEM data always stays blocked.
How does our HR data get into the platform?
Through a connection to Personio, rexx, Factorial, Lucca or Kombo – or as a DATEV file. We store the credentials for your HR system encrypted.
Questions about security?
Write to us – also if your data protection officer has their own questionnaire.
Get in touch