Skip to content
vivotempo
Sign inTwo monthsfree trial

Security and trust

Last updated: November 13, 2026

This page explains how vivotempo protects your data, where it is stored and which attestations exist. We only state what we can prove. A certificate we do not hold is listed here as not held.

At a glance

  • Database, files and server functions run in data centers in Paris, in the European Union.
  • Each company is separated from all others inside the database itself.
  • Second factor by passkey, authenticator app, Threema or a code by email.
  • The data processing agreement can be concluded online.
  • Administrators can export all of their company’s data themselves at any time.

Attestations and frameworks

The status of each framework and what already applies today.

  • GDPR

    Applies

    Directly applicable; there is no certificate for it. You conclude the data processing agreement (DPA) online, with a checksum and proof of acceptance. Annex 2 describes the technical and organisational measures, Annex 3 the sub-processors. We report personal data breaches within 24 hours where possible.

  • EU Data Act (switching providers)

    Applies

    Applies since September 12, 2025. Administrators download all of their company’s data themselves, in open formats with a description. See “Switching providers and data export”.

  • ISO/IEC 27001

    Not certified

    vivotempo is not certified. We align our measures and documentation with Annex A of the standard. The data centers of our service providers are certified to ISO/IEC 27001, among others.

  • Accessibility (EN 301 549, WCAG 2.2)

    Partially met

    Partially conformant at level AA, determined in a self-assessment with automated tests and manual checks.

    Read the accessibility statement

  • BSI C5

    Not assessed

    No attestation. For hospitals and medical practices in Germany, section 393 of Social Code Book V may require a C5 attestation or an equivalent proof when health data is processed in the cloud. Please talk to us before you start.

  • SOC 2

    Not assessed

    No report. SOC 2 has no levels of compliance: either a public accountant has issued a report or not. So we claim nothing.

Data location and service providers

vivotempo runs in the Paris region in France. These sub-processors work for us as agreed in Annex 3 of the DPA:

Vercel and Supabase are headquartered in the USA. Access from there is safeguarded by the EU-US Data Privacy Framework and the standard contractual clauses of the European Commission.

Emails also pass through a forwarding service run by Bergx2 GmbH itself.

Read the DPA with all annexes

How we protect data

  • Companies separated in the database

    Every table has row level security. A new table without such rules makes an automated test fail before release.

  • A second factor that really counts

    Anyone who has set up a second factor sees and changes nothing without a confirmed session. The database itself checks this on every access, not just the interface. Sign-in is locked after five failed attempts.

  • Roles

    Employee, team lead, HR and administrator with graded permissions. Health data such as sick notes is visible only to authorised roles.

  • Audit log

    Changes to employee data, requests, time entries and settings are logged with time and acting person. Corrections to time entries remain traceable. Entries older than 24 months are archived, not deleted.

  • Encryption

    All connections use TLS, and HSTS tells browsers to keep using it. Database and file storage are encrypted at rest, passwords are stored only as hashes.

  • Reviewed changes

    Every database change is a numbered, versioned file. Before every release, automated tests check the access rules, the application and the interface.

  • Terminals

    Clock-in terminals sign in with their own device key. If the network fails, they store bookings and send them later.

What we do not do

  • We do not sell data and do not pass any on for advertising.
  • We do not train AI models on your data.
  • Website and app load no third-party advertising or analytics services.
  • We do not recognise emotions and do not categorise people by characteristics. Face recognition at the terminal is an optional sign-in method and only identifies the person clocking in.

Switching providers and data export

Your data belongs to you. In the settings, administrators download all of their company’s data as a ZIP file, at any time and at no extra cost. It contains:

  • one CSV file and one JSON file per table with fixed column names
  • a description of the fields (JSON Schema) and instructions for importing
  • the uploaded files, for example certificates

Credentials and secrets such as password hashes, PINs, device keys, API keys and face features are not included. They are of no use in any other system and would only cause harm if passed on.

Report a vulnerability

Found a security issue? Write to info@bergx2.de with the subject “Security”.

We acknowledge receipt within three working days and respond with an assessment within ten working days.

Anyone who reports a vulnerability to us in good faith, and neither exploits nor publishes it before we have been able to fix it, has nothing to fear from us.

The same details in machine-readable form under RFC 9116: security.txt

Documents on request

On a justified request, customers receive:

  • details of the technical and organisational measures (under section 9 of the DPA)
  • a description of the export format
  • answers to security questionnaires

Go to the contact form