vemix.io
Sign inBook a demo
Sign inBook a demo

Your data, protected by design.

Hosted in the EU, isolated per company, encrypted in transit, with role-based access and an audit trail for all security-relevant changes.

GDPR-compliantEU hostingRFC-3161 timestampWorking-time law (ArbZG)
How we protect your data

Security on every layer

Hosted in the EU

Application and data run on Scaleway infrastructure entirely within the EU, behind Cloudflare for TLS, WAF and DDoS protection.

Workspace isolation

Every company has its own database. Access across companies is structurally impossible because the data is physically separated.

Encrypted in transit

All traffic runs over HTTPS only, with HSTS and a strict set of security headers; secrets are stored encrypted and rotatable.

Role-based access

Granular roles per module and record. The MCP server inherits the same permissions over OAuth.

Audit trail

Every sensitive change is logged: who, what and when, with old and new values. Exportable for review and compliance.

2FA & SSO

Two-factor authentication for all accounts. Sign-in with Google or Microsoft in every edition. SAML SSO and SCIM are available on request with the Enterprise plan.

Architecture

A separate database for every workspace.

vemix separates workspaces with their own PostgreSQL databases. Authentication runs over JWT with 2FA and SSO, billing through Paddle. vemix is operated on Scaleway infrastructure in the EU behind Cloudflare.

Cloudflare · TLS, WAF, DDoS protection
Scaleway · EU
PostgreSQL · one DB per workspace
JWT · 2FA · SSO (Google, Microsoft)
Signatures & GDPR

E-signature with timestamp, GDPR by design.

The signature module produces simple electronic signatures (SES) with an RFC-3161 timestamp and an audit certificate appended to the final PDF. Data export, deletion and minimisation are part of the product.

RFC-3161 timestamp on the sealed PDFData export & deletion built inTime tracking in line with German working-time law (ArbZG)
FAQ

Frequently asked questions

Which data is vemix not intended for?
Data covered by professional secrecy under section 203 of the German Criminal Code (StGB). This mainly means patient data, for example of doctors, dentists or psychotherapists, and client data of professionals bound by secrecy such as lawyers, tax advisers or auditors. vemix does not meet the legal and professional requirements for processing such data. It therefore belongs neither in vemix nor in its AI features. Our terms (AGB) and the data processing agreement say the same.
Where do the AI features process my data?
Content that an AI feature analyses, such as an email, a receipt or a contract, goes to open-weight language models that Scaleway runs in data centres in the EU. It is neither used to train models nor stored beyond the analysis. The only exception to the EU location is the web search in company research: it sends nothing but the company name and website address to Anthropic. Admins can switch off each AI feature individually for the whole workspace in the settings. If your workspace uses its own AI model for a feature, or you connect an AI assistant yourself via MCP, that provider processes the data under its own terms.

Questions about data protection or processing agreements?

We provide a data processing agreement, technical and organisational measures and a sub-processor list on request.

Start your free trialTalk to us