> For the complete documentation index, see [llms.txt](https://docs.kemperconnect.de/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.kemperconnect.de/legal/data-residency-and-security.md). # Data Residency & Security As of August, 2026 · Version 1.0 ### 0. Purpose of this document This document explains **where** data processed through KEMPER Connect is stored, **who** is involved in processing it, and **which** technical and organizational measures protect it. It is intended for customers, prospects, and IT and procurement departments — in particular outside the European Union — who need to assess the platform against internal data protection, IT security, or data residency requirements. This document is **informational**. It supplements and does not replace our [Terms of Service](https://docs.kemperconnect.de/legal/terms-of-service) and our [Privacy Policy](https://docs.kemperconnect.de/legal/privacy-policy). In the event of any conflict, those documents and any individually agreed contract terms prevail. *** ### 1. At a glance | Question | Answer | | ------------------------------------------------ | -------------------------------------------------------- | | Who operates the platform? | KEMPER GmbH, Vreden, Germany | | Where is measurement (device) data stored? | European Union — Frankfurt, Germany | | Where is account and personal data stored? | European Union — Frankfurt, Germany | | Where are backups stored? | European Union — Amsterdam, Netherlands | | Is any customer data stored in the US or Canada? | No | | Is a US or Canadian hosting region available? | No — the platform is operated exclusively from the EU | | How long is measurement data retained? | 12 months rolling by default, configurable up to 5 years | | Is data encrypted? | Yes — in transit and at rest, including backups | | Who owns the data? | The customer. KEMPER Connect does not sell or share it. | | Applicable data protection framework | GDPR (EU General Data Protection Regulation) | | Governing law | Federal Republic of Germany | *** ### 2. Platform and operating entity KEMPER Connect is operated by **KEMPER GmbH**, Von-Siemens-Str. 20, 48691 Vreden, Germany. KEMPER GmbH is your contracting party for all commercial and data protection matters relating to the platform. The platform is built on the **Datacake** IoT platform. Additional platform-level information is available in the [Datacake Security & Privacy documentation](https://docs.datacake.de/portal/security-and-privacy). *** ### 3. Where your data is stored All customer data at rest — device measurement data, account data, and backups — resides **exclusively within the European Union**. #### 3.1 Application backend and API The application backend (Python/Django) and the REST and GraphQL API layer run on **DigitalOcean** infrastructure in the **Frankfurt, Germany (FRA1)** region. The servers are administered by us directly, not by a third-party managed-application provider. #### 3.2 Measurement data (time series database) Device measurement data is stored in a **TimescaleDB** time series database, operated as a managed service by **Tiger Data (Timescale)**. The database instance runs on **Amazon Web Services in the Frankfurt, Germany region (eu-central-1)**. Data residency is configured to the European Union; measurement data is not replicated outside the EU. #### 3.3 Account and personal data Personal data — user accounts, workspace and tenant information, contact and contract data — is **not** stored in the time series database. It is held in a separate **relational database that we host and administer ourselves** on the infrastructure described in 3.1, and is not entrusted to a third-party managed database provider. All personal data therefore remains under our direct operational control. #### 3.4 Frontend delivery and API traffic The web frontend is delivered through **Vercel**, which serves the application shell and static assets (JavaScript, stylesheets, images) via its edge network. **Application data does not travel through this layer.** All API requests are made from the user's browser directly against our own endpoints on the EU infrastructure described in 3.1 and 3.2, via a dedicated KEMPER Connect backend layer. There is no proxying, no rewriting, and no routing of API traffic through Vercel. Measurement data and personal data are neither stored nor transited on the frontend delivery layer. #### 3.5 Backups Backups are taken continuously and remain within the European Union: * Multiple **snapshots per day** of the platform infrastructure. * One **full backup every 24 hours**, replicated to a secondary data center in **Amsterdam, Netherlands**. * Backups are retained on a rolling basis, so that a current restore point is always available. * The Amsterdam location serves as offsite backup storage and as a failover site should the Frankfurt location become unavailable. * Backups are encrypted at rest (see Section 5). #### 3.6 A note on corporate domicile vs. data location Some of the infrastructure providers listed in this document are headquartered in the United States. This concerns the **corporate domicile of the provider**, not the location of the data: the compute and storage resources used for KEMPER Connect are provisioned in EU regions, and customer data at rest does not leave the European Union. *** ### 4. Data separation and anonymization KEMPER Connect is designed so that measurement data and personal data are held apart from one another: * **Measurement data is stored without personal identifiers.** Records in the time series database are keyed to a high-entropy device identifier. They contain no user names, no company names, and no workspace descriptions. * **Personal data lives in a separate, self-hosted relational database** (see 3.3). * **The two are joined only in the authenticated frontend.** When a user opens the platform, the client requests data using their access token and assembles the view locally. This association is not materialized on the time series storage layer. * **Device-to-platform transmission is anonymous.** Devices transmitting via MQTT, REST API, LoRaWAN, or Particle.io identify themselves only by identifier and token; no personal or workspace-related data is transmitted in the process. The practical consequence: measurement data on its own carries no information about who generated it or which organization it belongs to. *** ### 5. Access control and security measures * **Encryption in transit.** The platform does not accept unencrypted inbound connections. All API and web traffic is TLS-secured. * **Encryption at rest.** Stored data is encrypted at rest across the platform. This covers the self-administered infrastructure and storage volumes as well as the managed time series database, where all data volumes including backups are encrypted with keys unique to each service and rotated at regular intervals. * **Token-based authorization.** Every action on the platform requires an access token. Each token carries a defined scope covering specific devices, workspaces, permissions, and roles. * **Granular token permissions.** Tokens can be issued per device and restricted to read or read/write access, so that a compromised device token exposes only that device. Tokens can be revoked and rotated individually. * **Workspace isolation.** A workspace is accessible only to its owner and to members explicitly invited by that owner. This includes KEMPER support staff, who have no access to a customer workspace unless the customer adds them as a member. * **Webhook validation.** Inbound webhooks from KEMPER Connect devices, LoRaWAN network servers and third-party platforms are validated via dedicated per-webhook tokens. * **Customer-side responsibility.** The security of tokens stored on customer devices, and the transport security of third-party devices and brokers, lies outside our control. We recommend per-device tokens with minimal scope. *** ### 6. Retention, export, and deletion * **Measurement data** is retained for **12 months per device** by default, on a rolling basis, and is available historically over that period. Longer retention periods of **up to 5 years** can be configured individually on request. * **Data export.** Customers can extract their data at any time via CSV export, Excel export, PDF reports, the REST API, and the GraphQL API. There is no technical lock-in on the data. * **Deletion by the customer.** When a customer deletes content or personal data from the platform, it is removed from productive systems immediately. Backup processes are designed so that deleted customer data is not retained longer than necessary. * **License expiry.** If a trial or voucher license expires without renewal, access to the affected device and its data may be restricted or deactivated. Reactivation is possible at any time with a valid voucher code. See Section 5.5 of the Terms of Service. * **Contract and communication data** is retained in line with statutory retention obligations under German commercial and tax law. *** ### 7. Using KEMPER Connect from the United States and Canada The platform is accessible over the public internet worldwide. The hosting location, however, remains in the European Union in all cases. * **Direction of data transfer.** When you access or use the platform from the United States or Canada, data associated with that use is transferred to Germany and processed there. This is set out in Section 14.2 of our Terms of Service. * **Cross-border transfer under Canadian law.** PIPEDA permits the processing of personal information by a service provider outside Canada, provided the organization remains accountable for that information and informs individuals that it may be processed abroad. As the controller, the customer is responsible for providing that notice to its own users and end customers. * **Local data residency requirements.** KEMPER Connect currently offers **no US or Canadian hosting region**, and customer data is not stored outside the European Union. Customers subject to binding in-country data residency obligations — for example certain Canadian provincial public-sector rules, or US federal programs such as FedRAMP — cannot satisfy those requirements with the platform as currently delivered. If such a requirement applies to your organization, please contact us directly so we can review it with you. * **Performance.** The underlying platform serves users across North America and other regions outside Europe from its EU infrastructure, and network latency has not proven to be a practical limitation in operation. Static frontend assets are delivered from edge locations close to the user; only data requests travel to Frankfurt, at intervals typical for telemetry and dashboard use. * **Availability.** The target availability of the platform is 99.5% per month, as set out in Section 6 of the Terms of Service. *** ### 8. Roles and responsibilities under data protection law * **Customer as controller.** If you transfer personal data of your employees, end customers, or other individuals to the platform, you are the controller within the meaning of the GDPR. * **KEMPER Connect as processor.** We process that data on your behalf under a **Data Processing Agreement (DPA)** pursuant to Art. 28 GDPR. The DPA is available on request at . * **GDPR as the operative baseline.** Because processing takes place in Germany, the GDPR standard applies to all customers, including those in North America, irrespective of whether it applies to the customer's own operations. * **US state privacy law.** In relation to personal information covered by US state privacy laws such as the CCPA/CPRA, KEMPER GmbH acts in the role of a service provider: personal information is processed solely to provide the contracted service and is not sold or shared for cross-context behavioral advertising. * **Data ownership.** Data recorded through your devices remains your property. It is not disclosed to third parties beyond the processors listed in Section 9. *** ### 9. Subprocessors The following service providers are involved in the provision of the platform. A complete and current list forms part of the DPA. | Provider | Function | Processing location | Basis for third-country transfer | | ------------------------------- | ------------------------------------------------ | ------------------- | -------------------------------- | | DigitalOcean | Backend, API, relational database hosting | Frankfurt, Germany | Not applicable (EU) | | Tiger Data / Timescale (on AWS) | Time series database | Frankfurt, Germany | Not applicable (EU) | | Vercel | Frontend delivery, edge and build infrastructure | Global edge network | Standard Contractual Clauses | | Brevo | Transactional email and newsletter delivery | EU (France) | Not applicable (EU) | | Crisp | Live chat and support messaging | EU (France) | Not applicable (EU) | | Cookiebot (Usercentrics) | Consent management | EU (Denmark) | Not applicable (EU) | | Google Analytics | Website analytics (consent-based) | USA | Standard Contractual Clauses | | Mixpanel | Product analytics (consent-based) | USA | Standard Contractual Clauses | | OpenAI | AI-assisted features | USA | Standard Contractual Clauses | | Anthropic | AI-assisted features | USA | Standard Contractual Clauses | Notes: * **Analytics providers** are activated only after the user has given consent through our consent banner. They process usage data, not device measurement data. * **AI features** are currently limited to documentation and assistance functions and transmit only the input data required for the respective function. Device measurement data is **not** currently processed by AI services. An extension of AI-assisted analysis to measurement data is planned; this document will be updated before any such change takes effect. *** ### 10. Certifications and scope limitations **Infrastructure certifications.** The data centers and infrastructure providers on which KEMPER Connect operates hold established security certifications: * **Amazon Web Services** (host of the time series database, Frankfurt) — ISO/IEC 27001 and SOC 1, SOC 2, and SOC 3. * **DigitalOcean** (host of backend, API, and relational database, Frankfurt) — SOC 2 Type II and SOC 3 Type II. * **Tiger Data / Timescale Cloud** (managed time series database) — SOC 2 Type II. These certifications cover the underlying infrastructure and hosting environment. A completed security questionnaire covering the KEMPER Connect application layer is available on request. **Regulated data.** The platform is not designed for compliance with sector-specific regulation, including HIPAA, FISMA, or GLBA. It may not be used to process data subject to those regimes. See Section 19.1 of the Terms of Service. **US government procurement.** Our services qualify as commercial items within the meaning of FAR 2.101; see Section 19.2 of the Terms of Service. **Intended user base.** KEMPER Connect is a B2B platform intended for commercial users aged 18 or over. It is not intended for consumers or minors. *** ### 11. Security incidents In the event of a personal data breach, we notify affected customers without undue delay in accordance with Art. 33 GDPR and the notification arrangements set out in the Data Processing Agreement. Customers acting as controllers remain responsible for any notifications owed to supervisory authorities and data subjects. Security concerns and suspected vulnerabilities can be reported at any time to . *** ### 12. Contact **KEMPER GmbH** Von-Siemens-Str. 20 48691 Vreden, Germany Phone: +49 (0) 2564 68 0 Email: **Data protection inquiries:** **Data Protection Officer:** Markus Olbring, comdatis it-consulting GmbH & Co. KG Deventer Weg 8, 48683 Ahaus, Germany Email: Requests for the DPA, the current subprocessor list, or a completed security questionnaire can be directed to . *** ### 13. Disclaimer The information in this document describes the configuration of the platform as of the date stated above. It is provided for information purposes and does not constitute a warranty, a guarantee of particular characteristics, or an independent contractual obligation. Infrastructure, providers, and processing locations may change as the platform develops; we will update this document accordingly. Binding commitments arise solely from the Terms of Service, the Privacy Policy, the Data Processing Agreement, and any individually agreed contract terms. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.kemperconnect.de/legal/data-residency-and-security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.