Data processing

This page summarises how Business Vault processes personal and business information stored by customers in the platform. It is an operational summary for customers and procurement teams. A signed data processing agreement can be discussed for organisation accounts that require one.

Roles. For account, billing, security, website and support records relating to Business Vault itself, Business Vault acts as a controller. For organisation content that customers enter or upload into the product, such as asset registers, ownership records, evidence files, monitoring notes and incident records, Business Vault processes that content to provide the service on the customer's instructions.

Processing purposes. Processing is limited to providing the Business Vault platform: authentication, tenant separation, storage, monitoring jobs, alerts, incidents, exports, billing status, support and security operations.

Location. Application hosting and database processing currently take place on Contabo GmbH infrastructure in Germany. Evidence files are stored on encrypted local application storage on that host. Payment processing is handled by PayPal.

Subprocessors. Current infrastructure and payment providers are listed on the subprocessors page.

Customer controls. Organisation administrators can invite and remove users, manage assets and evidence according to permissions, export organisation data where the product provides export, and request organisation closure. Closing an organisation deletes organisation records and stored files, subject to limited audit retention described in the privacy policy.

Security measures. Passwords are hashed with Argon2id. Sessions use HTTP-only cookies. Evidence and integration secrets are encrypted before storage. Access to organisation data follows authenticated roles and permissions. Important actions are written to an audit log.

Contact. Data processing questions: businessvault@businessvault.space.