Technical and Organisational Measures (TOMs) pursuant to Art. 32 GDPR

This English version is a convenience translation. In the event of any discrepancy, the German version at filehub.one/de/tom shall prevail.

Scope

These TOMs apply to workcentrix GmbH and filehub GmbH. Each company is the processor for the contracts it concludes; where one company processes data for the other without having its own contract with the customer, it is the other company’s sub-processor. The measures form Annex 2 of the respective data processing agreement (filehub.one/data-processing or workcentrix.de/avv) and are continuously adapted to the state of the art.

workcentrix does not operate DMS instances (e.g. Amagno) for customers; processing takes place via integrations that access the customer’s systems.

1 Confidentiality

1.1 Physical access control

• The systems run exclusively in data centres of the hosting partners in Germany. These are ISO/IEC 27001 certified and have access control systems, video surveillance and security staff.

• Employees of workcentrix and filehub have no physical access to the data centres.

• The business premises are secured against unauthorised access. Visitors are accompanied.

1.2 System access control

• Access to all systems only via personal, individually assigned user accounts. Shared accounts are not permitted.

• Server access exclusively via SSH with a personal key. Password login and root login by password are disabled.

• Secure password requirements apply to users. Multi-factor authentication is used wherever the respective service supports it.

• Screens lock automatically when inactive.

• When an employee leaves, all access is revoked and keys are withdrawn on their last working day.

1.3 Data access control

• A role- and permission-based concept ensures that authorised persons only access the data required for their task (need-to-know). Administrative rights are limited to a small, named group of persons.

• Decrypted access credentials to customer systems are used only at runtime for the respective integration call. They are not logged, not output in API responses, not displayed in development tools and not exported.

• Log files contain no access credentials or tokens and are only accessible to authorised administrators.

• Customer data is not stored on end devices or mobile storage media. A written policy applies to mobile working.

1.4 Separation control

• Data of different customers is processed logically separated. Every record and every document is assigned to a tenant; the document storage is structured per tenant.

• Separation is enforced at application level on every access and safeguarded by automated tests.

• Development, test and production systems are separated. No customer production data is used in development and testing.

1.5 Encryption

Data at rest. All storage media on which customer data is processed or stored are fully encrypted with LUKS/dm-crypt (AES-256-XTS). This includes document storage, database, temporary and cache directories and the backup targets.

Credentials and tokens. Access credentials to customers’ third-party systems, OAuth access and refresh tokens, API keys and client secrets are additionally encrypted field by field at application level (AES-256-CBC with HMAC-SHA-256). A failure of encryption aborts processing; unencrypted storage is technically excluded.

Keys. The key for access credentials is separate from the application key for sessions. Keys are not stored in the source code or in the database. They are rotated at least annually and on an ad hoc basis; existing data is re-encrypted in the process.

Transmission. All communication with the cloud services uses TLS 1.2 or higher with HSTS. Connections to the customer’s on-premises systems are encrypted with the strongest method supported by the customer’s server, in accordance with its specifications. The connection between application and database is TLS-encrypted with certificate verification. Access credentials transmitted by the DATEV agent from the customer network are additionally encrypted asymmetrically (RSA-3072, OAEP), so that they cannot be read even with TLS inspection in the customer network.

1.6 Remote maintenance and support

• Remote maintenance is carried out via AnyDesk with end-to-end encrypted sessions. As a rule, the customer starts the session and can observe and end it at any time.

• Unattended access is only set up if the customer has approved it in writing. The approval can be revoked at any time.

• Access via the customer’s VPN or RDP uses personal accounts assigned by the customer.

• Service accounts of the integrations only receive the rights required for the integration.

• No customer data is transferred to end devices of workcentrix or filehub during support sessions.

2 Integrity

2.1 Input control

• Entry, modification and deletion of data as well as changes to configurations and access credentials are logged with timestamp and acting user (audit trail).

• Encrypted fields are protected against manipulation by a message authentication code; manipulated records are detected and rejected during decryption.

2.2 Transfer control

• Data is only transmitted to recipients and interfaces configured by the customer, exclusively via encrypted connections (Section 1.5).

• Incoming files are checked for malware and impermissible formats before processing.

• No disclosure to third parties takes place beyond the published sub-processors.

3 Availability and Resilience

Databases and document storage are backed up daily and retained for 30 days at a location separate from the production system.

• The data centres have redundant power and network connections, UPS, early fire detection and air conditioning.

• Systems are monitored; in the event of disruptions, the responsible persons are notified automatically.

• Security updates are applied regularly, and dependencies are automatically checked for known vulnerabilities.

4 AI Processing

Classification, extraction and account assignment suggestions are controlled on our own systems in Germany; Mistral AI (EU) is used as the language and OCR model in filehub, filehubIDP and – if booked – in SmartBooking.

• Customer data is not used to train third-party models. It has been agreed with Mistral AI that transmitted data will not be used for training.

• Only the document data required for the respective task is transmitted to the language model.

• Learning data (e.g. account assignment patterns, vectors) is stored per tenant and deleted together with the tenant.

• Across tenants, only anonymised features without personal reference (e.g. layout features of supplier documents) are used on the basis of the data processing agreement. This use is enabled by default in filehub; the customer can disable it at any time in the settings.

• AI results are suggestions. Automated posting only takes place according to the rules and confidence thresholds configured by the customer.

5 Data Retention and Deletion

After the end of the contract, all data of a tenant is completely deleted no later than 90 days, including backups.

• On the customer’s instruction, data is also deleted before the end of the contract.

• Deletion is logged and confirmed in writing upon request.

• Storage media are destroyed by the hosting partners using recognised procedures.

6 Organisation and Regular Review

6.1 Data protection organisation

• There is no obligation to appoint a data protection officer (Section 38 BDSG). Data protection is the responsibility of the management, reachable at datenschutz@filehub.one or datenschutz@workcentrix.de.

• All employees of both companies have committed in writing to confidentiality and data protection and receive annual training on data protection and information security.

• Customer instructions are documented. Processing takes place exclusively within the scope of the data processing agreement.

6.2 Security incidents

• A documented process governs the detection, assessment, containment and documentation of security incidents.

• Personal data breaches are reported to the customer without undue delay, no later than 48 hours after becoming aware of them, with the information required by Art. 33(3) GDPR as far as known.

6.3 Processor control

• Sub-processors are checked for their TOMs before being engaged and are contractually bound in accordance with Art. 28 GDPR (Annex 3 of the respective data processing agreement).

• The customer is informed of changes to sub-processors in advance and may object.

6.4 Review and evaluation

• Security updates are applied regularly; dependencies are automatically checked for vulnerabilities.

• Penetration tests of all services take place at least annually.

• These TOMs, the cryptographic concept and the division of responsibilities with the hosting partners are reviewed annually and in the event of material changes.

• Data protection by default and by design (Art. 25 GDPR) are part of the development process.

As of: 1 July 2026

Sub-processors

The sub-processors engaged, including service, location of processing and safeguards, are published separately: filehub.one/subcontractors and workcentrix.de/weitere-auftragsverarbeiter. All sub-processors process customer data within the EU; hosting takes place exclusively in Germany.