Data processing agreement (DPA)

Ces textes juridiques sont disponibles en allemand et en anglais ; seule la version allemande fait foi. Le texte anglais est reproduit ci-dessous. Version allemande · Version anglaise

This agreement applies to organisations (businesses) that use EineEmail for their own users. It becomes part of the agreement when the organisation contract is concluded. A signed copy is available on request from info@cloudorax.com.

§ 1 Parties and subject matter

(1) The controller is the organisation that orders EineEmail for its users ("customer"). The processor is Cloudorax UG (haftungsbeschränkt), Nehringstraße 4 A, 14059 Berlin ("provider").

(2) The subject matter is the provision of email mailboxes, contacts, calendars and the related administration (admin console, domains, quotas, security log, where applicable SCIM/SSO and legal hold) under the main contract. The term corresponds to the term of the main contract.

§ 2 Nature, purpose, data and data subjects

(1) Nature and purpose: storing, transmitting and delivering email; managing accounts; defending against spam and malware; logging for security purposes.

(2) Types of data: account data (name, address, role, organisation), email content and attachments (stored only end-to-end encrypted or encrypted on receipt), contacts and calendar events (encrypted), metadata (sender, recipients, times, sizes, IP addresses), security events, public keys.

(3) Data subjects: the customer's users (employees and others) and their correspondents. Special categories of personal data may be contained in email content; it is stored encrypted and unreadable for the provider.

§ 3 Instructions

The provider processes personal data only on documented instructions from the customer, including this agreement and the settings in the admin console, unless required to do so by Union or German law; in that case it informs the customer of that requirement beforehand unless the law prohibits this. If the provider considers an instruction unlawful, it informs the customer without delay.

§ 4 Obligations of the provider

Confidentiality: persons authorised to process data are bound to confidentiality and to the secrecy of telecommunications.
Security: the provider implements the measures under Art. 32 GDPR set out in Annex 1 and adapts them to the state of the art without lowering the level of protection.
Assistance: it assists the customer with data subject requests (Art. 12–23 GDPR), data protection impact assessments and the obligations under Art. 32–36 GDPR, as far as possible given encrypted storage.
Notification: it notifies the customer of personal data breaches without undue delay, where possible within 24 hours of becoming aware, with the information under Art. 33(3) GDPR as available.
Government requests: it informs the customer of authority requests concerning its data where legally permitted (see the "Government requests & transparency" page).

§ 5 Sub-processors

(1) The customer approves the sub-processors listed in Annex 2.

(2) The provider informs the customer in text form at least 30 days before engaging or replacing a sub-processor. The customer may object for an important data protection reason; if no agreement is reached, it may terminate the main contract effective when the change takes effect.

(3) The provider contractually binds sub-processors to an equivalent level of protection.

§ 6 Transfers to third countries

Processing outside the EU/EEA only takes place under the conditions of Art. 44 et seq. GDPR. Currently this concerns Cloudflare (USA; EU-U.S. Data Privacy Framework, alternatively standard contractual clauses) and remote access from Türkiye for maintenance and troubleshooting (standard contractual clauses, access only via encrypted connections). All data is stored in Germany.

§ 7 Audits

The provider demonstrates compliance through appropriate documentation (e.g. documentation of measures, information, sub-processor evidence). In addition, the customer may carry out audits, or have them carried out by an auditor bound to confidentiality, after timely notice, usually 30 days, during business hours and without disrupting operations. Confidentiality of other customers' data is preserved.

§ 8 Deletion and return

After the main contract ends, the customer can export its data within 30 days. The provider then deletes the data within a further 30 days and confirms this on request, unless there is a legal obligation to retain it. Transparency log entries (email address and public key) are revoked, not deleted.

§ 9 Liability and final provisions

Liability is governed by Art. 82 GDPR; otherwise the liability provisions of the main contract apply. In case of conflict, this agreement prevails over the main contract on data protection matters. German law applies; the place of jurisdiction is Berlin.

Annex 1: Technical and organisational measures (Art. 32 GDPR)

Confidentiality

Zero-access storage: email content, contacts and calendar events are stored only encrypted (OpenPGP); private keys are with the user and are stored on the server only in a form we cannot decrypt. Incoming external email is scanned in memory and encrypted with the recipient's key before storage.
Transport encryption: HTTPS (TLS) for web, apps and API; STARTTLS for SMTP; when sending, the recipient domain's MTA-STS and DANE are honoured; own domain with MTA-STS in "enforce" mode.
Sender authentication: SPF, DKIM and DMARC for sent messages.
User access control: sign-in via Keycloak with password and optional two-factor authentication (TOTP); BIP-39 recovery phrase only with the user.
Administrative access: only for named administrators, via encrypted SSH connections with key authentication; services run separately in their own containers (tenant, outbound, gateway) with their own firewall rules; database access of individual services with minimal privileges (role-based permissions).
Roles in the customer's admin console; security log with truncated network addresses.

Integrity

Tamper-evident logs: security-relevant administrative operations are recorded in a chained, append-only audit chain.
Key transparency: public keys in an append-only Merkle log with signed states, checked by a witness service (currently operated by the provider; independent witnesses planned).
Signed web app releases.

Availability and resilience

Data centre of Hetzner Online GmbH in Germany.
Web access protected by Cloudflare (tunnel without publicly open web ports, WAF, rate limiting, Turnstile on registration).
Mail acceptance: unknown recipients are rejected with 550; malware and unscannable attachments are rejected; if scanning is unavailable, acceptance is temporarily refused (nothing passes unscanned).
System monitoring with alerting; automatic operating system security updates.
Backup: an encrypted backup is being set up.

Review and data protection by design

Regular security reviews and code reviews; logs with limited retention (web server 14 days, system and delivery logs at most 30 days).
Data minimisation: no analytics or tracking tools; blocklist queries only about the IP address of the sending server.

Annex 2: Sub-processors

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – data centre, servers and network (location Germany).
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA – delivery and protection of web access (tunnel, WAF, rate limiting, Turnstile), DNS; transfer based on the EU-U.S. Data Privacy Framework or standard contractual clauses. Email (SMTP) does not pass through Cloudflare.
Operations and remote maintenance from Türkiye: administration by the provider's managing director while in Türkiye, only via encrypted connections to the servers in Germany; safeguarded by standard contractual clauses. No data is stored in Türkiye.

Mise à jour: 18 October 2026