Oleh George Curta ·
Security & Compliance
Compliance means aligning every step of data processing with recognized standards. Under GDPR Article 83, violations can incur fines of up to €20 million or 4% of global annual turnover. anonym.legal provides enterprise-grade security following ISO 27001 standards, GDPR alignment, and German residency on certified infrastructure. GDPR has applied across all 27 EU member states since 2018.
Security Features
Comprehensive security measures at every level of our infrastructure. According to the IBM Cost of a Data Breach Report 2024, the global average breach cost reached $4.88 million, making strong technical controls a measurable financial safeguard. One limitation worth stating plainly: the ISO 27001 badge above reflects certification of Hetzner's hosting infrastructure, not an independent company-level ISO 27001 certificate held by anonym.legal itself.
ISO 27001 Standards
Following ISO 27001 security standards with comprehensive policies and controls on certified infrastructure.
GDPR Compliance
Full alignment with the EU General Protection Regulation including DPA support.
NIS2 Ready
Supporting EU NIS2 Directive requirements with encryption, pseudonymization, and audit capabilities.
German Infrastructure
All records processed in Hetzner's ISO 27001-certified facilities in Germany.
Encryption
TLS 1.2+ in transit, AES-256-GCM at rest. Your content stays encrypted at every step.
Two-Factor Auth
Optional 2FA with TOTP or email codes for enhanced account security.
How We Handle Your Information
Transparency is key. Here's exactly what happens to your files.
We Do
- Process your text in memory only
- Encrypt all traffic in transit (TLS 1.2+)
- Encrypt sensitive content at rest (AES-256-GCM)
- Maintain audit logs for compliance
- Process records only in Germany (EU)
✕We Don't
- ✕Store your original text content
- ✕Train AI models on your text
- ✕Share records with third parties
- ✕Transfer files outside the EU
- ✕Keep logs of processed content
Security FAQ
Is anonym.legal fully GDPR compliant?
Our architecture is built to support your GDPR obligations as a data processor — controller responsibilities rest with you as our customer under the DPA. All records are processed exclusively in Germany on ISO 27001-certified infrastructure. We offer Data Processing Agreements (DPA) for all customers and support all subject-access rights.
Where is my information stored?
Your text is processed in Hetzner facilities in Germany. We don't use AWS, Azure, or GCP - avoiding US Cloud Act jurisdiction entirely. Nothing leaves the EU.
Do you store the content I anonymize?
No. Text is processed in memory and immediately discarded. We only store metadata (token counts, timestamps) for billing. Your actual content is never persisted to disk.
What encryption do you use?
TLS 1.2/1.3 in transit, AES-256-GCM at rest. For Zero-Knowledge auth, we use Argon2id for password hashing and XChaCha20-Poly1305 for vault encryption in the Desktop App.
Can I get a DPA (Data Processing Agreement)?
Yes. We provide a standard GDPR-compliant Data Processing Agreement under Article 28 for all business customers. You can request yours from our DPA page.
Need More Details?
Explore our comprehensive security documentation or contact us for specific compliance requirements.