Security and privacy
Your data belongs to you. And you see every access.
Data centre in Frankfurt, two-factor sign-in, confidential and password-protected projects – and a log that records every access by us as the operator. No add-on, no extra cost.
Where your data is stored
Data centre in Frankfurt
Database, files and sign-in are in Frankfurt am Main (Supabase, region eu-central-1). is operated by openTS GmbH from Frankfurt.
Encrypted
Every connection is encrypted (TLS). Stored data and files are encrypted on disk (AES-256).
Daily backup
A backup is made every day and kept for 7 days – in case something ever goes wrong.
Who can see what
Companies strictly separated
Separation between companies is built into the database itself – not just the interface. One company cannot retrieve another company’s data.
Confidential projects
Only the project lead and members see them – not even admins. AI and client link are blocked there, every opening is recorded.
Password-protected projects
An extra password on top of signing in – for everyone, admins and owners too. Stored only as a hash, 5 wrong attempts mean a pause, every unlock is recorded.
Two-factor sign-in
With a code from an authenticator app. Mandatory for the whole company if you wish – the database then releases nothing without the second factor.
Automatic sign-out
After 15 minutes to 4 hours of inactivity – your company sets the time.
Card number block
Credit card numbers in tasks, comments, projects, client data and support requests are detected and rejected when saving. File attachments are not scanned.
AI can be switched off
AI features are labelled and can be turned off for the whole company. Then no data is sent to the AI service.
What we can do as the operator – honestly
Technically, any provider of cloud software can access the database – including us. The difference with : you decide when, and you see it.
- Support only with permission – owners grant access for 24 hours or 7 days. We then only look at what belongs to the problem – confidential and password-protected projects stay closed unless you explicitly ask. Nobody sees passwords. Access then ends by itself and can be ended at any time.
- Every change logged – if openTS changes anything in your data directly in the database, it is recorded automatically.
- Every look recorded – with time, reason and whether permission existed.
- Visible to owners – the log is in Settings under “Privacy & security”.
Your data, your decision
Download everything
Owners can download all data as one file at any time – projects, tasks, comments, people, clients. Without asking us.
Delete the company
Enter the company name, confirm – after a 14-day cooling-off period everything is permanently deleted: data, files, accounts. Until then any owner can cancel.
Contracts under German law
You receive a data processing agreement under Art. 28 GDPR, the technical and organisational measures and the list of sub-processors with the contract.
The services we use
runs on audited services. Audit information according to the providers.
- Supabase – database, files, sign-in. Location Frankfurt am Main (EU). SOC 2 Type 2.
- Cloudflare – delivery of the website and the app. ISO 27001, SOC 2.
- Resend – sending emails (notifications, morning briefing). Sent from Ireland (EU); provider based in the USA, covered by Standard Contractual Clauses. SOC 2.
- Anthropic – AI features, only if turned on. USA, Standard Contractual Clauses; your data is not used for training. SOC 2, ISO 27001.
- Browser push services (Google, Apple, Mozilla) – deliver push notifications, only if you turn on push on your device.
Frequently asked questions
Can openTS see my data?
Technically yes – as the operator, openTS can access the database, like any provider of cloud software. We only do so if you grant support access or it is strictly necessary for operation. Even with access we only look at what belongs to the request, and we never open confidential or password-protected projects unless you explicitly ask. Every change by us is logged automatically, every look is recorded. Your company’s owners see the log in Settings.
Where is our data stored?
Database, files and sign-in are in a data centre in Frankfurt am Main (Supabase, region eu-central-1). A backup is made daily and kept for 7 days.
Is certified?
itself has no certification of its own such as ISO 27001 or PCI DSS. According to the providers, the data centres and services runs on are audited to SOC 2 or ISO 27001. You receive a data processing agreement under Art. 28 GDPR with the contract.
How do I get my data back?
Owners can download all data as a file in Settings at any time – projects, tasks, comments, people, clients – without asking us.
What happens if we cancel?
You export your data and have the company deleted in Settings. After a 14-day cooling-off period all data, files and accounts are permanently deleted; they disappear from backups no later than 7 days after that.
Is the AI trained on our data?
No. The AI features use Anthropic’s API; according to the provider, data from this API is not used for training. Confidential and password-protected projects are never sent to the AI. You can turn off all AI features for the whole company – then nothing is sent to the AI service.