How we handle data · as of October 6, 2026
How we handle
data.
This page states plainly how SIMO GmbH handles data in its systems and in the Lab: what is in place today, what is in preparation, and where we deliberately are not yet.
1. GDPR: what is in place and how it is evidenced
Our own assessment, not an external audit. We do not put a percentage on it: nobody outside could recheck a figure like that. What follows are the points that actually matter.
Where a company brings its own personal data into a Lab project, SIMO GmbH first concludes a data processing agreement under Article 28; how that works is set out on its own page.
- Seven active sub-processors, documented, with four weeks’ notice before any change, as Article 28(2) GDPR requires.
- Operations in the EU: compute and backups at Hetzner in Germany, model inference at Modal Labs in Frankfurt.
- Data subject rights under Articles 15 to 22 GDPR: access and export on request, plus a documented deletion matrix.
- A data protection impact assessment under Article 35 exists for analytics; every new AI feature gets its own before it goes live.
2. EU AI Act: which duties apply and how they are met
Risk classification is mostly minimal; individual workflows fall under the transparency obligations of Article 50, often called limited risk.
In the Lab, SIMO GmbH is a deployer within the meaning of Article 3(4): it uses third-party general-purpose models, namely Apertus 8B and the Mistral family, for its own tests. It places no AI system on the market through the Lab.
- The transparency obligations under Article 50 are met: every AI-generated answer in the Lab’s systems is marked as such through a dedicated response header and a visible notice.
- Model cards for Apertus 8B and the Mistral family, with provider, license, knowledge cutoff, and usage limits.
- Every model call is logged for thirty days with model ID, client hash, token count, and response hash.
- No high-risk system: no use case in the Lab falls under Annex III today, so no biometric scoring, no candidate screening, and no education ranking.
3. ISO/IEC 27001: in preparation
Work on Annex A is underway, and some measures are still outstanding. The certification audit is planned for 2027; there is no certificate today.
Asset inventory, risk register, statement of applicability, and incident response are being built out; document control runs through the repository.
Hetzner, who runs the infrastructure, is certified to ISO/IEC 27001. At that layer the benefit already applies.
4. BSI C5: preparation from Q4 2026
Mapping the C5:2020 controls onto existing measures is underway, starting with operations, identity management, and key management.
No attestation has been issued to date.
5. Accessibility: partially compliant
Voluntary commitment to WCAG 2.1 Level AA, partially met today.
The accessibility statement is published and lists the known limitations and the feedback channel.
6. Schrems II and third-country transfers
The transfer impact assessment methodology is documented; the EU standard contractual clauses 2021/914 are in place with every US sub-processor wherever processing takes place in the United States.
The default is processing inside the EU. A transfer to the United States happens only when the relevant connector, such as Tavily or Microsoft Graph, is deliberately switched on for a project.
Microsoft is certified under the EU-US Data Privacy Framework.
7. Data sovereignty: where everything lives
| Storage location | Encryption | |
|---|---|---|
| Client project databases (PostgreSQL) | Hetzner, Germany | TLS in transit, LUKS at rest, column encryption for secrets with a rotating master key |
| Backups (daily, kept for thirty days) | Hetzner Storage Box, Germany | AES-256 on a separate key path |
| Language model prompts and responses | Modal Labs, Frankfurt | TLS in transit, no retention at the model backend |
| Uploaded files | Hetzner and Cloudflare R2 in EU buckets | TLS in transit, AES-256 at rest |
| Authentication secrets | Hetzner, Germany | Argon2id for passwords, master key held apart from the signing key |
| Support requests | Hetzner, Germany | TLS in transit, LUKS at rest |
8. Sub-processors: all seven of them
Role, region, and contractual basis for each provider. Clients with a data processing agreement are notified of any change by email four weeks in advance, as Article 28(2) GDPR requires.
| Role | Region | Safeguard | |
|---|---|---|---|
| Hetzner Online GmbH | Servers, storage, backups | Germany | Processing agreement, ISO/IEC 27001 |
| Cloudflare, Inc. | DDoS mitigation, firewall, DNS, tunnel | Global, EU-fronted | Processing agreement, EU standard contractual clauses, ISO/IEC 27001 |
| Modal Labs, Inc. | Compute for language models | EU (Frankfurt) | Processing agreement, EU standard contractual clauses, no retention |
| Tavily, Inc. | Web search, only with the client’s consent | United States | Processing agreement, EU standard contractual clauses |
| Microsoft Corporation | Microsoft 365 connector, only with the client’s consent | EU, at the client’s choice | Processing agreement, EU standard contractual clauses, EU-US Data Privacy Framework |
| GitHub, Inc. | Source code hosting, no client data | United States | Processing agreement, EU-US Data Privacy Framework |
| GitGuardian, Inc. | Secret scanning, no client data | EU | Processing agreement |
9. Certificates: only what genuinely exists
This section lists what we actually hold. External audit certificates are not among them yet. We keep the entries visible as an honest signal.
- ISO/IEC 27001: targeted for 2027.
- BSI C5: preparation from the fourth quarter of 2026.
- TISAX: no assessment so far; on request.
10. Contact and requests
For compliance inquiries, data processing agreements, vendor reviews, or auditor access.
Postal address: SIMO GmbH, attn. Compliance, Würzburger Straße 152, 63743 Aschaffenburg, Germany.
This page is reviewed at least quarterly, and additionally whenever the systems change materially.
- Compliance: compliance@simo-online.com
- Data protection: datenschutz@simo-online.com
- Accessibility: barrierefreiheit@simo-online.com