Question 1

Where is personal data hosted?

Accepted Answer

Primary processing is hosted in Germany (Netcup, Nuremberg). Asset storage is configured in AWS eu-central-1 (Frankfurt, Germany).

Question 2

Which subprocessors are used?

Accepted Answer

Documented subprocessors include Netcup, AWS (S3 API), Stripe, Postmark, GitHub, Cloudflare, and Plausible.

Question 3

Do you transfer data outside the EU?

Accepted Answer

Some integrations may involve non-EU transfers. Where applicable, safeguards under Art. 46 GDPR (for example Standard Contractual Clauses) are used.

Question 4

How can I request access or deletion of my data?

Accepted Answer

Data subject rights requests can be submitted via privacy@specularis.org, including access, rectification, erasure, restriction, portability, and objection.

Question 5

How long is personal data retained?

Accepted Answer

Personal data is retained only as long as necessary for the stated purpose and legal obligations, based on documented retention and deletion rules.

Question 6

Do you use customer content to train AI models?

Accepted Answer

Customer content is not used to train foundation models.

Question 7

How is customer data isolated?

Accepted Answer

All customer content (documents, versions, settings) is stored per workspace. Access is enforced in code: (1) Browser users must have a valid session and explicit membership in that workspace (OWNER, READ_WRITE, or READ_ONLY); every workspace-scoped API checks this before returning or changing data. (2) Code agents use Bearer tokens that are bound to a single workspace; each token can only read and write that workspace’s specs.

Question 8

How are incidents handled?

Accepted Answer

A documented incident and breach workflow is maintained, including GDPR-oriented risk assessment and a 72-hour notification decision path.

Question 9

Which privacy policy language is legally authoritative?

Accepted Answer

The German privacy policy version is legally authoritative. English content is provided for convenience.

Privacy & Trust

Policy language hierarchy

Technical privacy FAQ

Privacy FAQ

Policy language hierarchy

Key privacy facts

GDPR FAQ

Technical privacy FAQ

Privacy FAQ