Security and data protection

The security of your data is our priority

We transfer data encrypted and store it primarily in the EU; backups are encrypted too. We show openly how we protect it.

Personal data protection (GDPR)

EU hosting

Encrypted transfer and backups

Daily backups

2FA

OWASP Top 10

Where your data lives

The app and the database run on a Hetzner Cloud virtual server in Nuremberg (Germany) that we run only for our own services — it isn't shared hosting. We store backups and uploaded files with Backblaze in the EU (Amsterdam). Organizations share one database and are separated at the level of every record. Services from US providers (Anthropic, OpenAI, Backblaze, Resend, Sentry) rely on the EU–US Data Privacy Framework or standard contractual clauses (SCC) — see Sub-processors.

Data center: Hetzner Cloud, Germany (EU)

Infrastructure: A Hetzner Cloud virtual server for Můj Výkaz only, organizations separated at the record level

System security: Automatic security updates, hardening according to best practices

Network protection: Firewall + intrusion prevention

Developer access: Key-based authentication, no passwords

Primary hosting in the EU

Database and server in Germany, US integrations via DPF/SCC

Our own server in Germany (Nuremberg)

US services (Anthropic, OpenAI, Backblaze, Resend, Sentry, Stripe) via the EU–US DPF or SCC

Encrypted backups in an EU region (Backblaze B2)

DPA under Art. 28 GDPR

Automatic security updates

Let’s Encrypt SSL certificates

Encryption

Your data is protected at every level: at rest, in transit and in backups.

AES-256-GCM

At rest (stored data)

AES-256-GCM encryption of sensitive secrets — OAuth tokens (Fakturoid, iDoklad, Google Calendar, Freelo) and webhook signing secrets. Each record is encrypted individually with a unique IV. Passwords are hashed with scrypt. API keys are hashed with HMAC-SHA256 and a pepper.

TLS 1.3

In transit (data transfer)

All communication goes over TLS 1.3. HSTS with a one-year max-age and the preload directive. No data is sent over an unencrypted channel.

GPG RSA-4096

Backups

Encrypted daily database backups using GPG (RSA-4096). Only the holder of the private key can decrypt them. Backups are encrypted before they're sent to offsite storage.

Role hierarchy

Owner

Full control, ownership transfer, deleting the organization

Admin

User management, settings, invoicing, integrations

Vacation entitlements, absences, payroll data

Manager

Timesheet approval; money only for assigned clients

Accountant

Invoices, financial reports, export to accounting systems

Member

Own timesheets and absences; shared tasks and work plan; can't see other people's financial data

Access control

Every user has access only to what they actually need. 6 role levels with granular permissions.

Managers see money only for assigned clients; hours, tasks and the work plan are shared across the organization

2FA/TOTP — optional two-factor authentication for all roles

Session management — 7-day expiry, daily refresh

API keys — HMAC-SHA256 hashing with a pepper (defense in depth against offline cracking), rate limiting at 120 req/min, max. 5 per user

Passwords — at least 8 characters, with an uppercase letter, a digit and a special character

Backups

A multi-layer backup strategy keeps your data safe even in the worst case.

Automatic daily database backups (03:00 UTC)

GPG-encrypted (RSA-4096) before being sent anywhere

Local retention: 14 days on the server

Offsite retention: 30 days on Backblaze B2 (EU region)

Snapshots of the whole server (Hetzner Cloud Backups, 7 days)

03:00

UTC

Daily backup

days

Local retention

days

Offsite retention

RSA

4096

GPG encryption

Audit and monitoring

Every change is recorded. Every error is reported immediately. We regularly review the security of the whole application.

Audit log

A complete record of who changed what and when, including the IP address. Filterable and exportable. Available in Settings (admin/owner), and included in the GDPR export under Art. 20 (the user's actions over the last 365 days).

Sentry error tracking

Immediate error reports. Default personal data (IP, cookies, request body) isn't sent — a record carries only the user and organization identifiers and technical context. Data in the EU.

Internal security audit

A regular internal audit based on the OWASP Top 10 methodology. We check all 10 risk categories and fix the findings in the code.

Plausible Analytics

Self-hosted analytics without cookies. GDPR-friendly, no user tracking.

Protection against attacks

Rate limiting

Distributed rate limiting on all endpoints

SQL injection prevention

Table whitelist + parameterized queries

CSP headers

Content Security Policy without unsafe-eval

X-Frame-Options

DENY — protection against clickjacking

Timing-safe comparison

For API keys and tokens (crypto.timingSafeEqual)

HSTS

1-year max-age with the preload directive

CSRF hardening

POST-only cron endpoints, explicit multi-org ?org= routing

HMAC-SHA256 webhooks

24 signed event types, 3 retries, auto-disable after 10 failures

Stripe idempotency

DB-backed dedup, 30-day window, multi-replica safe

GDPR compliance

Compliance with EU Regulation 2016/679 (GDPR) isn't just a checkbox — it's the basis of how we build and run the service.

Data export (Art. 20) — Download all your data in JSON format with one click

Account deletion (Art. 17) — The right to be forgotten — profile anonymization, deletion of sign-in data

Record of accepted terms — Who accepted which version of the terms and the data processing agreement, and when

Data minimization — We process only the data needed to run the service

DPA for B2B — Data processing agreement under Art. 28 GDPR — published at mujvykaz.cz/dpa (in Czech), part of the terms

Incident response — For organizations' data, we inform the organization owner (the controller) within 48 hours, who decides whether to notify the supervisory authority; for data we're responsible for, we notify the Czech data protection authority (ÚOOÚ) within 72 hours (Art. 33 GDPR).

The full document

DPA (in Czech)

Data processing agreement

Sub-processors

Who processes the data you enter into the app. The binding list is in the data processing agreement (in Czech); this table is its translation.

Sub-processor	Location	Purpose	Data processed
Hetzner Online GmbH	EUNuremberg, Germany	Server and database	All data (server in the EU)
Backblaze, Inc.	DPF/SCCUSA (data in the EU, Amsterdam)	Backup copies; uploaded files (attachments, expense receipts)	Backups encrypted with our key; files encrypted on the storage side
Anthropic Ireland, Limited	DPF/SCCIreland (processing in the USA)	AI reports, support chat, reading receipts	The text of questions and queries (AI reports don't receive database results); receipt files together with the names of cost centers, clients and categories, to suggest how to file them. The data isn't used to train models
OpenAI Ireland Ltd.	DPF/SCCIreland (processing also in the USA)	Fallback AI — only when Anthropic's AI is down (AI reports; once the fallback is deployed, also support chat and reading receipts)	The same data as Anthropic for the same features; usually kept for no more than 30 days, not used to train models
Resend, Inc.	DPF/SCCUSA	Sending emails	Email addresses, names, email content
Sentry (Functional Software, Inc.)	DPF/SCCUSA (data in the EU, Germany)	Application error tracking	Diagnostic error records — may include the user ID and request context

Transfers to the USA rely on the EU–US Data Privacy Framework (for certified companies) and standard contractual clauses (SCC); for Anthropic and OpenAI, on SCC. We inform organization owners by email at least 14 days before any intended change of sub-processors (DPA clause 6.2). Stripe processes the payments for our subscription — we process that data as a controller (see the Privacy Policy); it isn't data entered into the app. Users turn on Google sign-in and Google Calendar themselves; Google processes that data under its own terms.

Frequently asked questions

Where is my data?

Your data is stored on a Hetzner Cloud virtual server in Nuremberg (Germany) that we run only for our own services (the app, the website and its analytics, a test environment with a separate database) — it isn't shared hosting. Organizations share one database and are separated at the level of every record. Primary hosting and the database are in the EU. Some services (AI, email, payments, error tracking) are provided by US companies; these transfers rely on the EU–US Data Privacy Framework or standard contractual clauses (SCC). The overview is in the Sub-processors section below and in the data processing agreement (mujvykaz.cz/dpa, in Czech). Backups are encrypted (GPG, RSA-4096) and stored locally (14 days) and offsite on Backblaze B2 in the EU region (30 days).

Do you have a DPA (data processing agreement)?

Yes. The data processing agreement under Art. 28 GDPR is published at mujvykaz.cz/dpa (in Czech) and is part of the terms of use — it's concluded together with them. It covers security, sub-processors, the processing period and the controller's rights. On request, we'll also sign it separately in the same wording (info@mujvykaz.cz).

Is Můj Výkaz GDPR compliant?

Data protection is built into the service and into our contracts: a published data processing agreement (mujvykaz.cz/dpa, in Czech), a privacy policy, data export under Art. 15 and 20, account deletion under Art. 17, a record of who accepted the terms, and data minimization (we process only what the service needs). We don't have an independent certification yet.

Do you need a DPO (data protection officer)?

We don't currently appoint a data protection officer (DPO), because as a small company we don't process personal data on a large scale (Art. 37 GDPR). We process health data (the “sick leave” absence type) only as a processor for our customers and on a small scale. Send security questions to info@mujvykaz.cz — we handle every report personally.

Have a security question?

Write to us at info@mujvykaz.cz — we handle every report personally and reply within 48 hours, in Czech or English.

Email the security team Try it free