Confidentiality, before the first access.

Why this page exists

Working with law firms, tax practices and medical practices means touching data covered by professional secrecy. Under German law (sec. 203 (3) sentence 2 StGB, as amended in 2017), professionals may involve external service providers. They must commit them to secrecy in text form beforehand and select them carefully. So this page sets out what the paperwork contains. For engagements from October 2026 on, you have it signed in hand before any access is set up.

Confidentiality commitment (sec. 203 StGB)

Our commitment covers, bindingly:

• Secrecy about every third-party secret learned during the work, explicitly beyond the end of the engagement and without time limit.
• Acknowledged awareness that unauthorised disclosure or use is a criminal offence under secs. 203 and 204 StGB.
• Passing information to our own staff or subcontractors only after an equivalent written commitment, and only to the extent required.
• Access limited to the data the agreed process actually needs; no access to case or patient files where the process does not touch them.
• Return or verified deletion of all data and access at the end of the engagement. How long copies in our backups remain after that is set out in the commitment.

Data processing agreement (Art. 28 GDPR)

For engagements from October 2026 on, we accept files and access containing personal data only once the data processing agreement is signed. The agreement covers subject, duration, nature and purpose, categories of data subjects, instruction-bound processing, support with data-subject rights, breach notification, audit rights, deletion and return. Sub-processors are named; new ones are announced in advance with a right to object. On request we sign your template instead of ours.

Technical and organisational measures

Measures are adapted to the specific process and annexed to the contract. Baseline:

• Personal accounts, multi-factor authentication where the system supports it, no shared logins.
• Least-privilege access, limited to the systems and periods the process requires.
• Encrypted transmission. Where data from your engagement is stored and backed up, and how it is protected there, is set out in Annex 1 of the data processing agreement. Servers in the European Union where the process runs on our own systems.
• Data from different clients is kept separate and never mixed.
• Logging of security-relevant events, so access is traceable if ever questioned.
• The services used are named with their location in the data processing agreement.
• Orderly termination: deletion or return after the engagement, with confirmation in text form (for example by email) on request. The period for copies in backups is set out in the data processing agreement.

Retention and German GoBD

Where our processes touch tax-relevant documents, retention happens in the electronic original format, unalterable and machine-readable, including the structured data of an e-invoice. Process documentation is part of the ongoing operation and is supplied for the part we build, so it exists when it is needed rather than being reconstructed afterwards.

Roles and liability

Where a firm recommends us, the client contracts with us directly. The firm is not a party to the implementation, receives no compensation for a recommendation and is not liable for our work. Professional responsibility stays entirely with the firm; we build and operate the technical route only.

How to request the documents

An informal message with one sentence about the planned process is enough. You receive the confidentiality commitment and the data processing agreement once the planned process is settled and the wording has been checked for it. For engagements from October 2026 on, you receive them before any access is set up in any case. No obligation arises from this.