How we handle our clients’ data, and who helps us do it.

With every client we conclude a data processing agreement under Art. 9 FADP and, where applicable, Art. 28 GDPR. It governs the subject and duration of the processing, instructions, confidentiality, technical and organisational measures, support with data subjects’ rights, notification of incidents within 24 hours, return and deletion at the end, and the list of sub-processors below. You receive the agreement text with our quote.

Principles

One database per client; data of different clients is never held in shared tables.
Documents are stored encrypted; every entry is immutable and chained to the previous one.
Every action in the application is logged with person, time and role; the log is visible to the client and can be exported.
Export of all data in open formats at any time; after the contract ends, deletion with written confirmation, and backups expire after their retention period.
Language models read receipts only if the client has switched this on.

Sub-processors

Provider	Purpose	Location	Legal basis
Hetzner Online GmbH	Servers, databases, document storage	Germany (EU)	Data processing agreement
Hetzner Online GmbH, Object Storage	Encrypted daily backups	Finland (EU)	Data processing agreement
Resend, Inc. / Amazon Web Services	Receiving and sending e-mail (receipts, invoices, notifications)	EU (Ireland) / USA	Standard contractual clauses
xAI Corp.	Reading receipts with a language model, only with the client’s consent	USA	Standard contractual clauses
SignWell, Inc.	Electronic signature of contracts	USA	Standard contractual clauses
Cloudflare, Inc.	Name resolution (DNS) for bluebooks.ch; no application traffic	USA / worldwide	Standard contractual clauses
The client’s banks and payment providers (e.g. Revolut, PostFinance, Stripe, Kraken)	Retrieving account movements and creating payment drafts on the client’s behalf	Per provider	The client’s agreement with the provider

We announce changes to this list to our clients 30 days in advance; they may object. A client whose contract requires data to be held in Switzerland is operated in a Swiss cell; its list of sub-processors differs accordingly.