Security & data sovereignty
Two questions decide an organisation’s data sovereignty: where the servers are, and who owns the company that runs them. On this page we answer both.
Hosting & operation
The platform services run on servers in Germany, operated by ScaleUp Technologies from Hamburg. No service runs on infrastructure from Amazon Web Services, Microsoft Azure or Google Cloud.
The individual services are built on open-source software: their source code is publicly visible and reviewed by a broad expert community, instead of disappearing into a closed system. The portal that connects these services we develop ourselves.
Which services those are in detail
For your records
Data protection officers and auditors need paper, not a brochure. On request you receive:
How data is backed up and restored is set out in the data processing agreement. A transfer to a third country is not envisaged, so standard contractual clauses and a transfer impact assessment are unnecessary.
As of July 2026
Data sovereignty
Many offerings sound European because the servers are in Europe. What’s decisive, though, is which law the operator is subject to. How that compares with American providers we’ve written up in our guide.
US provider with an EU data centre
Connecteeva
The “Clarifying Lawful Overseas Use of Data Act” of 2018 requires US companies to hand over data on the order of American authorities, regardless of where that data is physically stored. This also covers subsidiaries and infrastructure operated by US corporations outside the US. For a German operator with no US parent, this obligation doesn’t apply.
That doesn’t mean no one may ask: we too are bound by information requests from German authorities. The difference is that German law applies, with a transparent basis and German legal remedies.
Encryption
The path between your devices and our servers is always encrypted to current standards. Beyond that, you can specifically encrypt what’s especially worth protecting.
Emails can be encrypted using the open standards PGP and S/MIME, in the mailbox or in your usual program. Included in the mailbox at no extra charge.
This requires the other party to use PGP or S/MIME as well.
Confidential documents can be stored and shared encrypted, using the same open methods as email.
For counselling and confidential meetings, we set up your video calls encrypted on request.
All services sit behind a single sign-in. With two-factor login per person on request, at no extra charge.
Betrieb
Availability, response times and backups — the figures a board needs for a decision and an auditor needs for the records.
Infrastructure
Committed by ScaleUp Technologies, on whose infrastructure Connecteeva runs.
The response times apply to reports by phone and denote the time to first handling, not to restoration. Outside business hours they double. The availability commitment applies to the server pool operated by ScaleUp; the applications on top of it are our responsibility. Source: SLA by ScaleUp Technologies, retrieved in July 2026.
Connecteeva
What we commit to ourselves, on top of the infrastructure.
Leaving
A provider that promises independence has to describe the way out, too.
Traceability
In every account
Connecteeva logs administrative actions in the system. Who created an account, granted rights or enabled a service can be traced later, especially in organisations where several levels are allowed to administer.
Data protection officers, audits and boards need solid information. Tell us what you have to demonstrate, and we’ll answer as specifically as we can. Who we are is on our About page.
No contract and no payment details. You decide whether it stays an enquiry or you try Connecteeva right away.
Prefer to reach us directly? Send an email · call 030 994048000