Security and data protection
Tiro processes business documents — this page sums up where the data lives, who processes it and when it is deleted. All of it is set out bindingly in the data processing agreement and the privacy policy.
Hosting in Germany
Servers, database and document storage run with Hetzner Online GmbH in data centres in Germany. Error monitoring and web analytics are self-hosted on the same infrastructure — no data flows to external monitoring or analytics services, and the web analytics works without cookies.
Encryption and access control
Every connection is TLS-encrypted. Login codes, session and API keys are stored hashed only. Server access is possible via SSH key only, all services run in containers without root privileges behind a firewall. Technical logs contain no document content; access logs with IP addresses are deleted after 7 days at the latest.
AI extraction without training
Extraction uses Anthropic models via Amazon Bedrock in the AWS Frankfurt region with an EU inference profile — requests stay within EU regions. Customer documents are never used to train AI models.
Retention and deletion
Retention is configurable per inbox: delete right after export, after 7, 30 or 90 days, or after 1 year. The free plan allows at most 90 days, paid plans at most 1 year — there is deliberately no unlimited retention. Documents and results can be deleted manually at any time; daily backups are overwritten after 7 days.
Subprocessors
Tiro uses exactly two subprocessors, both bound by contracts under Art. 28 GDPR. We announce changes at least 30 days in advance.
| Provider | Purpose | Processing |
|---|---|---|
| Hetzner Online GmbH | Hosting (servers, database, document storage) and email delivery | Germany |
| Amazon Web Services EMEA SARL | AI extraction via Amazon Bedrock (Frankfurt region, EU inference profile); no training on customer data | EU |
Data processing agreement (DPA)
The DPA under Art. 28 GDPR is concluded electronically at registration. The German version is the binding one and is available as a PDF download; on the web it also exists as a page with an English convenience translation.
Download the DPA as PDF (German, version 20.08.2026)DPA as a web page · Privacy policy
Questions about security and data protection? Write to privacy@tirodocs.com.