Security foundations for tax firms

• Your client data never leaves the EU. Hosting in Germany (Hetzner, Nuremberg) with TLS encryption, regular backups and secured infrastructure.
• Role-based access controls, multi-factor protection and audit-ready logs.
• Retention: demo, pilot and log data follow defined deletion schedules.
• Demos use anonymized samples; pilot data is shared only under AVV and agreed TOMs.

• Keycloak (open source, CNCF project): central sign-in (OpenID Connect); GPAA itself never sees the password of a firm account.
• Passkey (WebAuthn/FIDO2): prepared in Keycloak; passwordless sign-in is not enabled yet.
• Two-Factor Authentication (2FA): Optional authenticator code (TOTP) in addition to password.
• Encrypted Transmission: TLS 1.3, HSTS, secure cookies — no plaintext passwords transmitted.
• Session Protection: sign-out after 30 minutes of inactivity, at the latest after 8 hours; protection against repeated failed attempts.
• Invitation System: Tax firm sets own password — no passwords sent via email, link expires after 12 hours.

Passwords are stored only as hashes in Keycloak (Argon2, Keycloak 26 default) — never in plain text, never in GPAA. Checked 29 Oct 2026.

Demo environments never hold real personal data; entries remain only for the current session and are deleted automatically after it ends.

Pilots process contact details, booking stacks and attachments solely under the AVV; this information is kept for a maximum of 12 months after the pilot ends or deleted earlier upon request, with structured backups retained for 30 days.

Operational and audit logs (errors, accesses, security events) remain for up to 90 days before automatic anonymisation or removal.

The order processing agreement (AVV) is signed before the pilot phase; a sample AVV (PDF) is available on request by email (info@dtnsoft.de). It outlines responsibilities, retention and deletion obligations together with your firm.

Concrete subprocessors:

• Hetzner Online GmbH – Region: Germany (EU); Purpose: Hosting of GPAA instances, snapshots and backups; Data types: encrypted customer data, infrastructure metrics and monitoring logs.
• Zoho (Zoho Corp, EU data centre) – Region: EU; Purpose: email delivery (SMTP) — contact form to us, invitations/password emails, reminders and support replies from GPAA; Data types: contact details, email texts, attachments only with explicit consent.
• OpenAI (API) – Purpose: optional AI suggestions for account and tax rate; off by default — documents go to the AI only after your firm switches it on. Data types: the document itself (image/PDF) with its content — it may contain names and addresses; the file name is not sent. Processing via the OpenAI API, also in the USA (OpenAI data processing agreement with standard contractual clauses); no training on your data; OpenAI keeps requests for up to 30 days for abuse monitoring, then deletes them. A suggestion is never applied automatically.