Hosted in Germany
HTTPS, configuration and archive outside the web root, GDPR-compliant data processing agreement with the data centre.
Trust through clarity
No security platitudes. Concrete boundaries.
myERP24 is a business application with roles, tenant context, audit and activation boundaries. This page explains how the application protects data – and how this website is hosted.
The application
Security, permissions & retention.
Hosting in Germany, GDPR-compliant data processing and evidence for every step.
Data vault
Credentials and files encrypted with AES-256-GCM, key rotation, every view logged.
Retention obligations
Periods under § 147 AO / § 257 HGB (10 · 8 · 6 years), anonymise instead of delete, complete evidence trail.
Audit-proof archive
Every document archived once with SHA-256, copy to Microsoft 365, GoBD export (Z3) at the push of a button.
Permissions & audit
Role matrix and permission profiles, enforced server-side; four-eyes principle on approvals; audit trail for every change.
Central configuration
Configuration centre with allow-list, secrets never in the browser, signed support-ticket intake with duplicate protection.
Integrations
Connections are assessed separately.
Microsoft 365, bank, AI API and e-invoice mailbox have different permissions, health checks and operational risks.
Microsoft 365
Storage with minimal site selection and target check; mail with minimal Graph permissions and Exchange RBAC.
Bank (FinTS)
PIN/TAN with pushTAN approval; credentials only in the data vault; no payments without approval.
AI API (EU)
Only key figures and the chart of accounts are transmitted – never postings, amounts or business partners. Data processing agreement included.
Status per integration
Every integration carries the status “available”, “pilot”, “prepared” or “roadmap” – rotation, revocation and rollback are documented.
This website
Static, lean, no tracking.
The marketing website needs only static hosting: HTML, CSS, JavaScript, images and SVGs. No PHP, no database, no runtime API. The myERP24 application remains technically and legally separate.
Deployment
- Create domain or subdomain and determine the document root.
- Enable the HTTPS certificate and redirect HTTP to HTTPS.
- Copy the package contents to the web root via SFTP; keep the assets and language folders.
- Test the start page, language versions, images and contact links.
- Finally check legal notice, privacy policy and provider details.
- Before every update: back up the web root; rollback = restore the backup.
Requirements
| Component | Requirement |
|---|---|
| Web server | Apache web space serving static files |
| PHP / database | Not required |
| Browser | Modern browsers with standard JavaScript |
| HTTPS | Enable for publication |
| Contact | E-mail link (mailto), no server-side storage |
Technical contact: [name and contact]. Hosting contract: [customer number/contract name, documented internally].
For procurement & IT
The right questions before rollout.
Where is data processed?
In a data centre in Germany. You receive hosting, backup and data processing documentation before signing.
Which integrations are actually active?
Every integration carries the status “available”, “pilot”, “prepared” or “roadmap”. A feature counts as productive only when revision, permission, activation and a positive live test line up.
How is a team onboarded?
With a role matrix, data and process capture, 30-day pilot, sign-off and a documented rollback plan – not just a login.
What happens to my data on termination?
Full export (CSV, PDF, DATEV) and deletion after the agreed periods; documents subject to retention remain exportable for you.
Contract documents
DPA and Terms for download.
The contractual basis for using myERP24 as PDF.
↓
Data Processing Agreement (DPA)
Art. 28 GDPR, with annexes on data categories, TOMs, sub-processors and the revocable approval for product improvement (§ 11).
PDF ↓↓
General Terms and Conditions
SaaS software provision: availability, rights of use, data export, GoBD responsibility, liability, term.
PDF ↓i
Note
Drafts for legal review. Convenience translations – the signed or in-app accepted German version is binding.
Technical dialogue
Want to examine the activation boundaries in detail?
We prepare a structured product and security dialogue.