Trust center
Security, data protection and operations
Data lives on Holigov’s own hardware in Germany, separated per organisation, or in your data centre on request. Connections terminate on our own access server in Germany, with no US network service in the data path. This page lists the providers involved, the documents you can get and what is still in development.
At a glance
- Data location
- Holigov’s own hardware in Germany. On-premises or air-gapped in your data centre on request.
- Access
- Own access server at IONOS in Berlin, TLS certificates from Let’s Encrypt, attack protection with CrowdSec. Decryption happens in Germany.
- Separation
- One tenant per organisation, separated from all others, one release per tenant.
- Sign-in
- Keycloak with OIDC, optionally connected to openDesk or your identity provider.
- Web analytics
- Matomo on our own server, only with consent. No web analytics and no advertising SDKs in GovLaw.
- Language models and training
- Analyses run on our own hardware. GovLaw and GovCloud: no content from your data goes into training any model. GovDash and GovIntel: analysed data also improves the Holigov models, which benefits every customer’s analyses; details are set out in the contract.
Providers involved
These providers are involved in running the website and the Holigov Cloud. Others are only added with notice and a contract.
| Provider | Purpose | Location | Access to content |
|---|---|---|---|
| IONOS SE | Access server (edge) and email delivery | Germany | Encrypted pass-through; emails from the contact form |
| Mistral AI | Language model for longer drafts in GovLaw, until our own GPU takes over | France (EU) | Only with a data processing agreement and an agreement under § 43e BRAO |
| Cloudflare, Inc. | Name resolution (DNS) until the move in early 2027 | USA | None, name resolution only |
| Let’s Encrypt (ISRG) | Issuing TLS certificates | USA | None, domain names only |
Documents
We send these documents on request, usually as PDF:
- Data processing agreement under Art. 28 GDPR
- Technical and organisational measures (TOM)
- List of sub-processors with date
- SBOM and changelog per release (on-premises and air-gapped)
- Agreement under § 43e BRAO (GovLaw)
Report a vulnerability
If you have found a vulnerability, write to hello@holigov.de with the subject “Security”. We confirm receipt and get back to you with next steps. The reporting route is also published in /.well-known/security.txt.
Accessibility
The target is WCAG 2.1 AA. Status 27 October 2026: automated testing with axe on 23 pages without findings, Lighthouse accessibility 100. A screen reader review is still pending. Please report barriers to hello@holigov.de.
Status and what comes next
What runs today and what is in development, in one place.
- Access server in Germany, tenant separation, sign-infor website, Holigov Cloud and appslive
- GovIntel self-operatedtoday on mandate, a person reviews every statementin development
- Backup at a second site with rehearsed restorefor the Holigov Cloudin development
- Container registry for customer systemsGovCloudin development
- Own GPU for longer drafts in GovLawthen without an external language modelplanned
- DNS with a provider in the EUmove in early 2027planned
- Screen reader accessibility reviewwebsiteplanned