GDPR & Security

Our Security Measures at a Glance

Confidentiality

Confidentiality refers to the aspect that it is ensured that a message can only be viewed by the group of people intended for it and remains protected from outside access or publication.

  • TLS encryption: We encrypt all connections between the client, i.e. your end device, and our servers with TLS (better known under the name of the previous version SSL). This prevents user input and data from being tapped on the transport route.
  • Hosting in Germany: Hosting exclusively at Deutsche Telekom.
  • Certifications: The data center used by Echometer is ISO 27001 certified, among other things (view all certifications).
  • Internal security guidelines: Secure passwords for all accounts, key authentication on servers. All accounts with access to personal data are protected with 2-factor authentication where possible.

Availability

Availability describes the extent to which a system is able to implement the requirements received by the user within a limited period of time.

  • Transparent high availability: Public Uptime Monitor
  • Monitoring: Continuous monitoring of our systems enables us to intervene quickly in the event of malfunctions.
  • Backups: Automated regular backups ensure the availability of your data. Backups are regularly checked for recoverability.

Integrity

Integrity is about the fact that information can only be written and modified by the intended people.

  • Access to data is only possible via password-protected accounts.
  • For the encryption of passwords, we use hashing with current and secure methods (PBKDF2) with various salts, so even if our data is leaked, no password can be extracted, not even with hashtables.
  • Basically, it depends on you how strong your password is: In order to support you in creating the password, we provide information when registering what a relatively secure password can look like.

Order Processing According to GDPR ☑️

As a customer of Echometer, a company must conclude a contract with Echometer GmbH as a data processor for order processing (also known as "Data Processing Agreement" / DPA) in accordance with the General Data Protection Regulation (GDPR).

With each subscription/contract conclusion, the current contract for order processing at the time of the contract conclusion becomes an integral part of the contract.

Here you can download the complete contract for order processing and associated TOMs as a PDF:

Current version (2025 06)

Valid for new customers from June 11, 2025.

Updates

We improve our contracts for commissioned processing and adapt them to new framework conditions on an ongoing basis.

If we (Echometer) adapt the contract for order processing in the future and thus replace the previous version, the workspace admins in Echometer will receive a notification by email.

History of previous versions

Version 2025 02

Effective between 21.01.2025 and 10.06.2025.

Version 2024 05

Effective between May 8, 2024 and January 20, 2025.

Version 2024 03

Effective between March 13, 2024 and May 7, 2024.

Version 2023 08

Effective between August 31, 2023 and March 12, 2024.

Version 2023 05

Effective between May 1, 2023 and August 30, 2023.

Version 2022

Effective before May 2023.