Security
Last Updated: Nov 07, 2026
General
We take appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, disclosure, or misuse. Our infrastructure is designed so that access to systems and data is limited according to operational requirements and individual authorization levels.
Access to databases, storage systems, and other infrastructure components is restricted to services and personnel that require such access for their respective functions. We apply access controls and follow the principle of least privilege to reduce unnecessary access to personal data.
Credentials, access tokens, and other sensitive configuration information are managed separately from application code and are protected against unauthorized access. Where appropriate, we also use encryption, authentication mechanisms, logging, monitoring, and other security measures to protect our systems and the information processed through them.
We regularly review our technical and organizational safeguards and adapt them where necessary to reflect changes to our infrastructure, security risks, and the services we provide.
Security by Design
Security is an integral part of how we build and operate Palagus. We apply security measures throughout our development, deployment, and infrastructure processes to protect our systems and customer data.
Security Updates & Patch Management
We continuously maintain our software, infrastructure, and dependencies and apply security updates and patches as appropriate. Dependencies and application components are regularly reviewed for known vulnerabilities, allowing us to identify and address potential risks throughout the development lifecycle.
Vulnerability Management
Our systems and codebase are regularly assessed for security vulnerabilities. We use automated security checks and monitoring to identify potential weaknesses and suspicious activity.
Identified vulnerabilities are evaluated based on their severity and potential impact and are prioritized accordingly. Particular attention is given to common application security risks such as injection attacks, cross-site scripting (XSS), authentication weaknesses, exposed credentials, and improper access controls.
Infrastructure Security
Our infrastructure follows a layered architecture in which individual services only receive the access required for their specific function. Databases, application services, authentication systems, and other infrastructure components are separated and protected through appropriate access controls.
Administrative and infrastructure access is restricted to authorized personnel. We follow the principle of least privilege and limit access to production systems and customer data to what is necessary for operating and maintaining the service.
Credentials, API keys, tokens, and other secrets are managed separately from our application code and protected from unauthorized access.
Secure Development
Security is integrated into our software development process. Source code and changes are managed through version control, and changes may undergo automated testing, code review, and security checks before reaching production.
Changes involving sensitive functionality, authentication, permissions, data access, or other security-critical components receive additional attention during development and review.
Monitoring & Incident Detection
We monitor our infrastructure and applications to identify operational problems, unusual behavior, and potential security issues. Logging and monitoring mechanisms help us investigate incidents, detect problems, and understand events affecting the reliability or security of our services.
Security-related findings are assessed, prioritized, and addressed based on their severity and potential impact.
Availability, Backups & Recovery
Our infrastructure is designed with availability and resilience in mind. We use backup and recovery mechanisms appropriate to the individual systems and rely on redundancy and availability capabilities provided by our infrastructure providers.
These measures are designed to reduce the risk of data loss and allow services and data to be restored following technical failures or other incidents.
Access Control
Access to sensitive systems and information is restricted based on operational responsibilities. We apply role- and permission-based controls where appropriate and regularly limit access to the individuals and services that require it.
Authentication and additional security mechanisms are used to protect access to critical infrastructure and administrative functions.
Security is an integral part of how we build and operate Palagus. We apply security measures throughout our development, deployment, and infrastructure processes to protect our systems and customer data.
Security Updates & Patch Management
We continuously maintain our software, infrastructure, and dependencies and apply security updates and patches as appropriate. Dependencies and application components are regularly reviewed for known vulnerabilities, allowing us to identify and address potential risks throughout the development lifecycle.
Vulnerability Management
Our systems and codebase are regularly assessed for security vulnerabilities. We use automated security checks and monitoring to identify potential weaknesses and suspicious activity.
Identified vulnerabilities are evaluated based on their severity and potential impact and are prioritized accordingly. Particular attention is given to common application security risks such as injection attacks, cross-site scripting (XSS), authentication weaknesses, exposed credentials, and improper access controls.
Infrastructure Security
Our infrastructure follows a layered architecture in which individual services only receive the access required for their specific function. Databases, application services, authentication systems, and other infrastructure components are separated and protected through appropriate access controls.
Administrative and infrastructure access is restricted to authorized personnel. We follow the principle of least privilege and limit access to production systems and customer data to what is necessary for operating and maintaining the service.
Credentials, API keys, tokens, and other secrets are managed separately from our application code and protected from unauthorized access.
Secure Development
Security is integrated into our software development process. Source code and changes are managed through version control, and changes may undergo automated testing, code review, and security checks before reaching production.
Changes involving sensitive functionality, authentication, permissions, data access, or other security-critical components receive additional attention during development and review.
Monitoring & Incident Detection
We monitor our infrastructure and applications to identify operational problems, unusual behavior, and potential security issues. Logging and monitoring mechanisms help us investigate incidents, detect problems, and understand events affecting the reliability or security of our services.
Security-related findings are assessed, prioritized, and addressed based on their severity and potential impact.
Availability, Backups & Recovery
Our infrastructure is designed with availability and resilience in mind. We use backup and recovery mechanisms appropriate to the individual systems and rely on redundancy and availability capabilities provided by our infrastructure providers.
These measures are designed to reduce the risk of data loss and allow services and data to be restored following technical failures or other incidents.
Access Control
Access to sensitive systems and information is restricted based on operational responsibilities. We apply role- and permission-based controls where appropriate and regularly limit access to the individuals and services that require it.
Authentication and additional security mechanisms are used to protect access to critical infrastructure and administrative functions.
Security is an integral part of how we build and operate Palagus. We apply security measures throughout our development, deployment, and infrastructure processes to protect our systems and customer data.
Security Updates & Patch Management
We continuously maintain our software, infrastructure, and dependencies and apply security updates and patches as appropriate. Dependencies and application components are regularly reviewed for known vulnerabilities, allowing us to identify and address potential risks throughout the development lifecycle.
Vulnerability Management
Our systems and codebase are regularly assessed for security vulnerabilities. We use automated security checks and monitoring to identify potential weaknesses and suspicious activity.
Identified vulnerabilities are evaluated based on their severity and potential impact and are prioritized accordingly. Particular attention is given to common application security risks such as injection attacks, cross-site scripting (XSS), authentication weaknesses, exposed credentials, and improper access controls.
Infrastructure Security
Our infrastructure follows a layered architecture in which individual services only receive the access required for their specific function. Databases, application services, authentication systems, and other infrastructure components are separated and protected through appropriate access controls.
Administrative and infrastructure access is restricted to authorized personnel. We follow the principle of least privilege and limit access to production systems and customer data to what is necessary for operating and maintaining the service.
Credentials, API keys, tokens, and other secrets are managed separately from our application code and protected from unauthorized access.
Secure Development
Security is integrated into our software development process. Source code and changes are managed through version control, and changes may undergo automated testing, code review, and security checks before reaching production.
Changes involving sensitive functionality, authentication, permissions, data access, or other security-critical components receive additional attention during development and review.
Monitoring & Incident Detection
We monitor our infrastructure and applications to identify operational problems, unusual behavior, and potential security issues. Logging and monitoring mechanisms help us investigate incidents, detect problems, and understand events affecting the reliability or security of our services.
Security-related findings are assessed, prioritized, and addressed based on their severity and potential impact.
Availability, Backups & Recovery
Our infrastructure is designed with availability and resilience in mind. We use backup and recovery mechanisms appropriate to the individual systems and rely on redundancy and availability capabilities provided by our infrastructure providers.
These measures are designed to reduce the risk of data loss and allow services and data to be restored following technical failures or other incidents.
Access Control
Access to sensitive systems and information is restricted based on operational responsibilities. We apply role- and permission-based controls where appropriate and regularly limit access to the individuals and services that require it.
Authentication and additional security mechanisms are used to protect access to critical infrastructure and administrative functions.
How we secure your data
Data Storage & Encryption
Customer data is stored within protected infrastructure and is not intended to be directly accessible from the public internet. Access to data stores is restricted to the applications, services, and authorized personnel that require it for their specific function.
We protect data in transit using encrypted connections such as Transport Layer Security (TLS) and use encryption at rest where supported by the underlying infrastructure. Sensitive credentials, API keys, and other secrets are managed separately from application code.
Production systems and data are separated from development and testing environments to reduce unnecessary exposure of customer information.
Data Segregation & Access
Customer accounts, organizations, and associated data are logically separated using unique identifiers and access controls. Our application is designed to ensure that users can only access information belonging to the organizations and workspaces for which they have been authorized.
Internal access to customer data is restricted according to the principle of least privilege. Access is limited to authorized personnel where it is necessary for support, security, maintenance, or other legitimate operational purposes.
Backups & Recovery
We use backup and recovery mechanisms designed to protect against accidental data loss and support recovery following technical failures or other incidents.
Backups are protected separately from normal application access and are subject to defined retention and deletion procedures. Because backup systems operate independently from active production databases, information deleted from the application may remain temporarily within existing backups until those backups reach the end of their retention period.
Recovery procedures are reviewed and maintained to ensure that critical systems and data can be restored when necessary.
Logging & Monitoring
We use technical logs and monitoring to maintain the reliability and security of Palagus, investigate errors, detect unusual activity, and analyze potential security incidents.
We aim to minimize personal data contained in technical logs and limit logging to information necessary for operational, diagnostic, and security purposes. Access to logs is restricted according to operational requirements.
AI & Customer Data
Where Palagus uses artificial intelligence or external AI models to provide product functionality, customer data is processed only as necessary to provide the respective feature.
We do not use customer data to train our own general-purpose AI models. Where third-party AI providers are involved, we select and configure services with data protection, security, and appropriate data-handling requirements in mind.
I would make the distinction between processing data with AI and using data for model training very explicit. For an AI product like Palagus, this is likely one of the first things a B2B security reviewer will look for.
Secure Infrastructure
Palagus uses a distributed infrastructure in which different responsibilities are separated across dedicated components. Database storage, authentication, application delivery, and background processing are handled independently, reducing unnecessary access between systems.
Access between infrastructure components is restricted to what is required for their respective function. Administrative access to sensitive production infrastructure is limited to authorized personnel and protected through appropriate authentication and access-control mechanisms.
Secure Development
Security is incorporated into our development process. Changes to our codebase are managed through version control and may undergo automated testing, code review, dependency checks, and additional security review before deployment.
We monitor dependencies and infrastructure components for relevant security issues and address identified vulnerabilities according to their severity and potential impact.
Availability & Resilience
Palagus is designed with availability and recoverability in mind. We rely on redundancy, monitoring, backups, and recovery capabilities across our application and infrastructure to reduce the impact of individual system failures.
Our infrastructure and security measures are continuously reviewed as Palagus grows and our technical architecture evolves.
When you access the Palagus website, we process technical information to: deliver the website to your device, maintain website availability and performance, protect the website against misuse and attacks, identify and resolve technical problems, understand how the website is found and used, where applicable, operate application and login functionality.
Collection of General Data and Server Log Files
When you access our website, certain general technical information may automatically be transmitted by your browser or device and recorded by our systems. Depending on the configuration of the website and your device, this may include your IP address, date and time of access, requested pages or resources, referring website, browser type and version, operating system, device information, language and regional settings, technical identifiers, as well as error and security-related information.
This information is processed primarily to deliver the website correctly, maintain the security and stability of our systems, identify and investigate technical problems or potential misuse, and improve the performance and functionality of our website.
Where possible, this information is evaluated without directly identifying individual users. However, certain technical information, particularly IP addresses, may constitute personal data. Server log information is not combined with other personal data for the purpose of identifying individual visitors unless this is necessary for security, fraud prevention, or the investigation of unlawful activity.
Legal basis
The delivery, stability, and security of the website are based on our legitimate interests under Article 6(1)(f) GDPR. Our legitimate interests are: providing a secure and functional website, protecting our systems and users, detecting misuse, resolving errors, maintaining the technical integrity of Palagus. Where a technology requires access to or storage of information on your device and is not strictly necessary, we will request consent before activating it. The corresponding processing of personal data is based on Article 6(1)(a) GDPR.
Website Host
We use Framer (Framer B.V., NL) to host our website.
Cookies and Similar Technologies
Our website uses cookies and similar technologies to support its functionality and improve the overall user experience. Cookies are small text files that are stored on a user's device when visiting a website through a web browser.
Cookies may contain identifiers that allow a browser to be recognized when it returns to our website. This helps us distinguish between different browser sessions and, where applicable, remember certain settings or preferences.
We use cookies for various purposes, including operating essential website functions, remembering user preferences, improving the usability of our services, and understanding how visitors interact with our website. Depending on the type of cookie, they may also help us analyze website performance and optimize our content and services.
Some cookies are necessary for the website to function properly, while others are only used with the user's consent. Where consent is required, such cookies will not be activated until the user has made the corresponding choice.
Users can manage or disable cookies through the settings of their browser and, where available, through the cookie preferences provided on our website. Cookies that have already been stored can generally be deleted at any time through the browser settings. Please note that restricting or disabling certain cookies may affect the availability or functionality of parts of our website.
Optional analytics, heatmap, session-recording, advertising, or similar technologies are activated only where the required consent has been obtained.
Under Section 25 TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz), storing information on or accessing information from a user’s device generally requires informed consent, except where the activity is strictly necessary for transmission or for a digital service expressly requested by the user. Where the technology also processes personal data, the GDPR applies in addition.
Processors
Google Search Analytics: We use Google Search Console to understand how our website appears and performs in Google Search. The information available through Search Console may include: search queries, impressions, clicks, average positions, landing pages, countries and devices, indexing information and website errors and technical search information. Google states that Search Console does not show all data and may omit certain low-volume queries or queries containing personal or sensitive information to protect privacy. We use this information to:maintain the discoverability of the Palagus website, identify technical indexing problems, improve website content, understand aggregated search performance. The related processing is based on our legitimate interests under Article 6(1)(f) GDPR in maintaining and improving our business website.
Google Analytics 4: We use Google Analytics, a web analytics service provided by Google, to understand how visitors interact with our website and to improve its content, usability, performance, and overall effectiveness.
When you visit and interact with our website, Google Analytics may collect information about how the website is accessed and used. Depending on the configuration of the service and your device, this may include information about pages viewed, events and interactions, the date and time of visits, session information, referral sources, approximate geographic location, as well as technical information about your browser, device, operating system, and screen characteristics. Google Analytics uses cookies and similar technologies to measure and associate interactions with our website.
This information allows us to obtain aggregated insights into the use of our website. For example, we may use Google Analytics to understand which pages are frequently visited, how visitors navigate through our website, how they arrive at our website, which features or content are used, and where technical or usability issues may occur. We use these insights to improve our website, evaluate its performance, and make our content and services more relevant to our users.
For users located in the European Union, Google states that individual IP addresses are not logged or stored in Google Analytics. IP addresses may initially be used to derive approximate geographic information, such as the city, country, or region from which a request originates. According to Google, the IP address is then discarded before the relevant measurement data is processed further.
Where required by applicable law, Google Analytics is only activated after you have given your consent. You can manage your preferences and, where applicable, withdraw previously given consent at any time through the cookie or privacy settings available on our website. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.
The information collected through Google Analytics is processed for analytics and measurement purposes. Depending on our configuration, Google provides various privacy controls that allow the collection of certain data to be restricted. These controls include options relating to advertising features, detailed location and device information, data retention, and the collection of Google Signals data.
We use the information provided through Google Analytics to analyze website usage on an aggregated basis, monitor the performance of our website, identify technical or usability problems, and continuously improve our website and services. We do not use Google Analytics to intentionally collect information that directly identifies you, such as your name or email address. Google also prohibits customers from sending personally identifiable information to Google Analytics.
Google processes information collected through Google Analytics in accordance with its applicable privacy and data protection terms. Depending on the processing infrastructure and services involved, data may also be processed outside the European Economic Area. Information regarding international data transfers and the safeguards applied to such transfers should therefore also be considered together with the section on third-country transfers in this Privacy Policy.
You can prevent or limit analytics processing by rejecting analytics cookies through our consent settings or by withdrawing your consent at a later time. Google also provides mechanisms for disabling Google Analytics data collection, including a browser opt-out add-on.
Further information about the processing and protection of data in connection with Google Analytics is available in Google's information on data privacy and security.
Google Tag Manager (GTM): We use GTM to organize and manage the tracking technologies used on our website. Google Tag Manager itself serves primarily as a tool for deploying and controlling other services. With your consent, we also use Microsoft Clarity to gain insights into how visitors use our website and, where relevant, the Palagus web application. This helps us understand user behavior and improve the usability of our services. For advertising and conversion measurement, we use Google Ads. If you consent to marketing technologies, Google Ads may use cookies or similar identifiers to measure the effectiveness of our campaigns and support remarketing activities. In this context, information such as device identifiers and browsing activity may be processed by Google.
Contacting us via our website
If you contact us by email, through a contact form, or via another communication channel provided on our website, we process the information you choose to provide. This may include your name, email address, contact details, and the content of your message. We use this information to respond to your inquiry, communicate with you, and handle any related requests. Your information is retained only for as long as necessary for these purposes or where required by applicable law.
When you access the Palagus website, we process technical information to: deliver the website to your device, maintain website availability and performance, protect the website against misuse and attacks, identify and resolve technical problems, understand how the website is found and used, where applicable, operate application and login functionality.
Collection of General Data and Server Log Files
When you access our website, certain general technical information may automatically be transmitted by your browser or device and recorded by our systems. Depending on the configuration of the website and your device, this may include your IP address, date and time of access, requested pages or resources, referring website, browser type and version, operating system, device information, language and regional settings, technical identifiers, as well as error and security-related information.
This information is processed primarily to deliver the website correctly, maintain the security and stability of our systems, identify and investigate technical problems or potential misuse, and improve the performance and functionality of our website.
Where possible, this information is evaluated without directly identifying individual users. However, certain technical information, particularly IP addresses, may constitute personal data. Server log information is not combined with other personal data for the purpose of identifying individual visitors unless this is necessary for security, fraud prevention, or the investigation of unlawful activity.
Legal basis
The delivery, stability, and security of the website are based on our legitimate interests under Article 6(1)(f) GDPR. Our legitimate interests are: providing a secure and functional website, protecting our systems and users, detecting misuse, resolving errors, maintaining the technical integrity of Palagus. Where a technology requires access to or storage of information on your device and is not strictly necessary, we will request consent before activating it. The corresponding processing of personal data is based on Article 6(1)(a) GDPR.
Website Host
We use Framer (Framer B.V., NL) to host our website.
Cookies and Similar Technologies
Our website uses cookies and similar technologies to support its functionality and improve the overall user experience. Cookies are small text files that are stored on a user's device when visiting a website through a web browser.
Cookies may contain identifiers that allow a browser to be recognized when it returns to our website. This helps us distinguish between different browser sessions and, where applicable, remember certain settings or preferences.
We use cookies for various purposes, including operating essential website functions, remembering user preferences, improving the usability of our services, and understanding how visitors interact with our website. Depending on the type of cookie, they may also help us analyze website performance and optimize our content and services.
Some cookies are necessary for the website to function properly, while others are only used with the user's consent. Where consent is required, such cookies will not be activated until the user has made the corresponding choice.
Users can manage or disable cookies through the settings of their browser and, where available, through the cookie preferences provided on our website. Cookies that have already been stored can generally be deleted at any time through the browser settings. Please note that restricting or disabling certain cookies may affect the availability or functionality of parts of our website.
Optional analytics, heatmap, session-recording, advertising, or similar technologies are activated only where the required consent has been obtained.
Under Section 25 TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz), storing information on or accessing information from a user’s device generally requires informed consent, except where the activity is strictly necessary for transmission or for a digital service expressly requested by the user. Where the technology also processes personal data, the GDPR applies in addition.
Processors
Google Search Analytics: We use Google Search Console to understand how our website appears and performs in Google Search. The information available through Search Console may include: search queries, impressions, clicks, average positions, landing pages, countries and devices, indexing information and website errors and technical search information. Google states that Search Console does not show all data and may omit certain low-volume queries or queries containing personal or sensitive information to protect privacy. We use this information to:maintain the discoverability of the Palagus website, identify technical indexing problems, improve website content, understand aggregated search performance. The related processing is based on our legitimate interests under Article 6(1)(f) GDPR in maintaining and improving our business website.
Google Analytics 4: We use Google Analytics, a web analytics service provided by Google, to understand how visitors interact with our website and to improve its content, usability, performance, and overall effectiveness.
When you visit and interact with our website, Google Analytics may collect information about how the website is accessed and used. Depending on the configuration of the service and your device, this may include information about pages viewed, events and interactions, the date and time of visits, session information, referral sources, approximate geographic location, as well as technical information about your browser, device, operating system, and screen characteristics. Google Analytics uses cookies and similar technologies to measure and associate interactions with our website.
This information allows us to obtain aggregated insights into the use of our website. For example, we may use Google Analytics to understand which pages are frequently visited, how visitors navigate through our website, how they arrive at our website, which features or content are used, and where technical or usability issues may occur. We use these insights to improve our website, evaluate its performance, and make our content and services more relevant to our users.
For users located in the European Union, Google states that individual IP addresses are not logged or stored in Google Analytics. IP addresses may initially be used to derive approximate geographic information, such as the city, country, or region from which a request originates. According to Google, the IP address is then discarded before the relevant measurement data is processed further.
Where required by applicable law, Google Analytics is only activated after you have given your consent. You can manage your preferences and, where applicable, withdraw previously given consent at any time through the cookie or privacy settings available on our website. Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.
The information collected through Google Analytics is processed for analytics and measurement purposes. Depending on our configuration, Google provides various privacy controls that allow the collection of certain data to be restricted. These controls include options relating to advertising features, detailed location and device information, data retention, and the collection of Google Signals data.
We use the information provided through Google Analytics to analyze website usage on an aggregated basis, monitor the performance of our website, identify technical or usability problems, and continuously improve our website and services. We do not use Google Analytics to intentionally collect information that directly identifies you, such as your name or email address. Google also prohibits customers from sending personally identifiable information to Google Analytics.
Google processes information collected through Google Analytics in accordance with its applicable privacy and data protection terms. Depending on the processing infrastructure and services involved, data may also be processed outside the European Economic Area. Information regarding international data transfers and the safeguards applied to such transfers should therefore also be considered together with the section on third-country transfers in this Privacy Policy.
You can prevent or limit analytics processing by rejecting analytics cookies through our consent settings or by withdrawing your consent at a later time. Google also provides mechanisms for disabling Google Analytics data collection, including a browser opt-out add-on.
Further information about the processing and protection of data in connection with Google Analytics is available in Google's information on data privacy and security.
Google Tag Manager (GTM): We use GTM to organize and manage the tracking technologies used on our website. Google Tag Manager itself serves primarily as a tool for deploying and controlling other services. With your consent, we also use Microsoft Clarity to gain insights into how visitors use our website and, where relevant, the Palagus web application. This helps us understand user behavior and improve the usability of our services. For advertising and conversion measurement, we use Google Ads. If you consent to marketing technologies, Google Ads may use cookies or similar identifiers to measure the effectiveness of our campaigns and support remarketing activities. In this context, information such as device identifiers and browsing activity may be processed by Google.
Contacting us via our website
If you contact us by email, through a contact form, or via another communication channel provided on our website, we process the information you choose to provide. This may include your name, email address, contact details, and the content of your message. We use this information to respond to your inquiry, communicate with you, and handle any related requests. Your information is retained only for as long as necessary for these purposes or where required by applicable law.