TRANSPARENCY
Where your data is located, who accesses it, and how long we keep it.
Anyone purchasing cybersecurity must first be able to trust the provider. This page answers questions from data protection audits and procurement in advance - with legal bases, deletion periods, and contractual commitments for each service.
Four principles that apply to every project
Storage in Germany
We store project and case data on our own infrastructure at Hetzner in Germany. We list all subprocessors used in the DPA – including their location.
Contract before access
Before we process data from your systems, we conclude a data processing agreement in accordance with Art. 28 GDPR - in an emergency, also at short notice in text form.
data minimization
We only process what is necessary to provide the service—metadata, logs, and events within ongoing services, not content data such as patient or customer records. During incident handling, we only access system content at your instruction and only to the extent necessary.
Defined deletion
For each data category, there is a defined retention period and documented erasure. No indefinite retention.
What we process per service - and for how long
The Cyber Risk Assessment and the four services differ significantly in the data they generate. That is why they are broken down separately here instead of in a generalized statement.
Cyber Risk Assessment
PROCESSED DATA
Existing documents and records—reviewed on-site rather than copied where possible—notes from interviews, the site inspection report, and the assessment workbook. As well as contact details for your points of contact.
STORAGE
Assessment records are kept until the re-assessment, for a maximum of 13 months following the final presentation. After this period, we will delete or return them—earlier upon request.
SPECIAL FEATURE
Stored on our own infrastructure at Hetzner in Germany, with encrypted exchange. No access to your systems, no scans. We always sign a non-disclosure agreement (NDA) — as well as a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR whenever personal data is processed on your behalf.
Phishing Simulation
PROCESSED DATA
Name and email address of the participants, click and reporting events with timestamp, as well as technical connection data (IP address, browser identification).
STORAGE
Personal data will be completely deleted no later than 90 days after the end of the campaign.
SPECIAL FEATURE
Evaluation is strictly aggregated. No individual evaluation, no disclosure of individual results, not a basis for personnel decisions.
Awareness training
PROCESSED DATA
Participation status, module, date, duration.
STORAGE
Verification period according to your audit requirements.
SPECIAL FEATURE
Aggregation at the department level. We do not create individual evaluations of employee performance.
Vulnerability Management
PROCESSED DATA
Asset inventory, configuration, and vulnerability data.
STORAGE
Contractually agreed project period.
SPECIAL FEATURE
Raw scan data is transmitted in encrypted form. Access is restricted to named individuals and is fully audited.
Incident Response
PROCESSED DATA
Contact details and incident information, incident log and report, and, upon your instruction, exports and evidence from your systems.
STORAGE
Incident log and report for three years. All other data will be deleted or returned upon completion - with written confirmation.
SPECIAL FEATURE
Case files are hosted exclusively with Hetzner in Germany, and shared via password-protected links. For healthcare institutions, the duty of confidentiality pursuant to Section 203 of the German Criminal Code (StGB) additionally applies.
On which legal basis we operate
Data Processing Agreement, Art. 28 GDPR
Across the four ongoing services, we act as a data processor. You remain the data controller under the GDPR and retain the right to issue instructions. The Data Processing Agreement (DPA) is concluded before the start of the project and governs the purpose, scope, subcontractor relationships, and deletion. For the Cyber Risk Assessment, we clarify in advance whether personal data will be processed on your behalf—a DPA is only required if this is the case.
Legitimate interest, Art. 6 (1) lit. f GDPR
The legal basis for the phishing simulation is legitimate interest in IT security. A proper implementation is required: solely aggregated evaluation, no individual sanctions, and transparent prior notice to the workforce. All three conditions are part of our standard procedure.
Codetermination, Sec. 87 para. 1 no. 6 BetrVG
Phishing simulations are subject to co-determination because they can be considered a technical system for monitoring behavior. We provide a complete model works agreement as well as all data protection proof right from the initial consultation. In the public sector, the same applies in accordance with the respective state Staff Representation Act (Landes-PersVG).
Which standards we align ourselves with
Entropy CS was founded in 2024 and does not currently perform its own certifications. Our procedures are aligned with the following frameworks.
NIS2 / BSIG - our services generate evidence in line with the measures from § 30 BSIG
GDPR - Data processing in accordance with Art. 28, reporting processes in accordance with Art. 33
Industry-Specific Security Standards (B3S) from the BSI - such as for healthcare or water and wastewater
ISO/IEC 27001 - Structure of our internal information security management
IEC 80001-1 - Risk management for IT networks incorporating medical devices
Participant of the Alliance for Cyber Security of the BSI.
Confidentiality and collaboration
Confidentiality
All employees and deployed freelancers are contractually bound to confidentiality. This obligation continues to apply beyond the end of the collaboration.
NDA on request
Upon request, we can provide a mutual non-disclosure agreement (NDA) for pre-contractual discussions. This is not necessary for the free Risk Check, as we do not collect any sensitive technical details there.
Reference mention only with approval
We do not disclose customer names without express written consent. Even anonymized case studies are coordinated with you beforehand.
Access principle
Access to customer data is granted exclusively to individuals who require it for service delivery. Access is logged.
What happens to your information during the free Risk Check
What we collect
Your details from the 30-minute conversation regarding organization, system landscape, and current security status. No access data, no technical scans, no access to your systems.
What you get
A written report with a maturity assessment, NIS2 classification, and prioritized immediate measures - in a format ready to be shared with management, the board, or the supervisory board.
What it costs
Nothing. No hidden costs, no subsequent obligation, no automatic transition into a contractual relationship.
What happens to the data
We use your details exclusively to generate your report and to contact you. No sharing with third parties. Upon request, we will delete everything after delivering the report - an informal note by email is sufficient.
The Risk Check provides an initial assessment and does not replace a comprehensive technical inspection.
Questions about data processing?
For questions regarding data processing, deletion periods, or our DPA, you can reach us directly at: info@entropy-cybersecurity.com · +49 30 863283641
The processing of data when visiting this website is described separately in our privacy policy.