Trust and security

Your data stays yours. Protected and available.

For a manufacturing platform, security is not a feature; it is the precondition for doing business at all. The data that flows through Dropslab describes how you build your products. This page sets out, in concrete terms, what is in place today and where we are expanding, and we would rather say that plainly than overstate either.

  • Hosted in Germany

    Hetzner data centres. All customer data stays within Germany and the EU.

  • Your AI, your data

    Models are trained per customer and never reused. You own the data and the models.

  • GDPR and DPA ready

    Full GDPR compliance with a data processing agreement available on request.

  • Cloud, on-prem or edge

    Deploy the way your data-governance rules require, including fully on-premise.

Data security

We protect customer data in transit and at rest, and we keep each customer’s data isolated.

Encryption in transit
All connections are encrypted using TLS 1.2 or higher.
Encryption at rest
Stored data is encrypted at rest using volume encryption provided by our hosting infrastructure (Hetzner).
Tenant isolation
In the cloud, each customer’s data is logically separated on shared infrastructure; a dedicated instance per customer is available on request. In on-premise deployments, data is physically separated within your own environment.
Backups
Regular, encrypted backups with a tested restore process, retained for 90 days.

Hosting and infrastructure

Dropslab is hosted in Germany on Hetzner, a German infrastructure provider. All data therefore resides within Germany and the EU. Hetzner operates ISO/IEC 27001-certified data centres, which forms the physical and infrastructural foundation our platform builds on.

Provider and location
Hetzner, Germany (EU).
Data residency
Customer data is stored within Germany / the EU.
Infrastructure certification
Hetzner data centres are ISO/IEC 27001-certified.
Availability
We build for resilience and continuity. We do not publish a fixed uptime percentage unless it is contractually agreed with you, so as not to imply a guarantee we have not committed to.

Data protection and GDPR

We process personal data in accordance with the EU General Data Protection Regulation (GDPR). For business customers, we provide a data processing agreement (DPA / Auftragsverarbeitungsvertrag) governing how we handle data on your behalf.

Data processing agreement
Available on request.
Data location
All customer data is stored within Germany / the EU.
Sub-processors
Our current sub-processor is Hetzner (hosting), listed in the DPA. The DPA is kept up to date if this ever changes.
Data subject rights
We support access, rectification, deletion and portability requests in line with the GDPR.
Data deletion
After your contract ends, customer data is deleted by default within 19 days; shorter or longer on request.

AI and your data

This is the first question every buyer of an AI platform asks, so we answer it plainly: you own your data, and you own the models built from it.

Ownership
Your production data, and the models trained on it, are your property. We deliver trained models to you in standard formats (e.g. PyTorch).
Per-customer training
We train models separately for each customer. No other customer can access your data or your models.
No reuse
We do not reuse your data or your models for other customers or other projects.
No third-party sharing
Your data is not shared with third parties beyond the sub-processor listed in our DPA (Hetzner, for hosting), and only to deliver the service to you.

Access and identity

Access to your Dropslab environment is controlled and assigned by role. We are transparent about this distinction on purpose: RBAC is live now; the additional access controls are on a defined roadmap rather than something we claim prematurely.

Role-based access control
In place today: permissions are assigned by role, so users only see what they need.
In development
Single sign-on (SSO), multi-factor authentication (MFA) and detailed audit logging are being implemented as part of our ISO 27001 / SOC 2 programme.

Certifications and standards

We list only what we hold or are formally pursuing. As part of this programme, we are aligning our practices with the ISO 27001 control set.

ISO/IEC 27001
Certification in preparation, targeted for Q4 2026.
SOC 2
In preparation, targeted for Q4 2026.
TISAX (automotive)
Planned, in recognition of automotive supply-chain requirements.
Infrastructure
Our hosting runs in ISO/IEC 27001-certified Hetzner data centres in Germany.

Building our security programme

We are honest about where we are: alongside our ISO 27001 / SOC 2 certification work, we are formalising operational security processes, including continuous monitoring, a documented incident-response process with customer notification, and regular penetration testing by an external provider. We would rather flag these as work in progress than present controls we have not yet established. We are happy to discuss our current status and timeline directly with prospective customers under NDA.

Deployment options

Many plants are not permitted to send production data to the cloud. Dropslab is therefore available in three deployment models, so the platform fits your data-governance requirements rather than forcing you to change them.

  • Cloud / SaaS

    Hosted by us on Hetzner in Germany.

  • On-premise

    Runs entirely within your own environment, with physical data separation.

  • Edge

    Processing directly on the shop floor, for plants that keep data local.

Reporting a security vulnerability

We welcome reports from security researchers and customers. If you believe you have found a security issue in Dropslab, please contact us so we can investigate and respond responsibly. Include enough detail to reproduce the issue, and allow us reasonable time to remediate before any public disclosure. We will acknowledge your report and keep you informed of our progress.

security@dropslab.com

Frequently asked questions

Where is our data stored?

In Germany, hosted on Hetzner, so within Germany and the EU.

Do you use our data to train your AI models for anyone else?

No. We train models separately for each customer, never reuse your data or models for other customers or projects, and deliver the trained models to you as your property.

Are you certified to ISO 27001 / SOC 2 / TISAX?

ISO 27001 and SOC 2 are in preparation, targeted for Q4 2026; TISAX is planned. Our hosting already runs in ISO 27001-certified data centres.

Can we run Dropslab on-premise or at the edge?

Yes. We offer cloud/SaaS, on-premise and edge deployments.

Will you sign our DPA, and who are your sub-processors?

Yes, we provide a DPA on request. Our current sub-processor is Hetzner (hosting), listed in the DPA.

What happens to our data when we leave?

By default, customer data is deleted within 19 days of contract end; shorter or longer on request.

Have a security or compliance question?

We are happy to walk your security and procurement teams through our controls, our roadmap and our DPA, including under NDA.

Talk to us Privacy policy