Trust Center

Your data. Transparently protected.

Everything your privacy and legal team needs in one place: where PathHub AI stores your data, which subprocessors we use and how we protect it.

Request a DPAPrivacy policy
GDPR-compliantProcessing under the GDPR, contractually safeguarded
Hosted in GermanyData center in Falkenstein, ISO 27001
DPA for business customersIncluding EU Standard Contractual Clauses
No training on your dataYour content is never used to train models

Data location & hosting

Your project data, i.e. descriptions, tasks, budgets, risks, stakeholders and AI chat histories, is stored in a database on servers in Germany.

GermanyHetzner data center in Falkenstein, ISO 27001-certified
TLSEncrypted transfer between browser, app and services
DailyAutomatic backups that expire after their retention period

Subprocessors

We use a small number of carefully selected service providers. Each is bound by a data processing agreement (DPA); where processing takes place outside the EU, we additionally safeguard it with EU Standard Contractual Clauses (SCC).

HetznerGermany (EU)
Purpose
Hosting & database
Data
Project data
DPA
CloudflareEU / global
Purpose
DNS & network security
Data
Technical access data (e.g. IP)
DPASCC
ResendUSA
Purpose
Transactional emails (e.g. verification)
Data
Email address
DPASCC
StripeEU / USA
Purpose
Payment processing
Data
Email address, plan; payment details go directly to Stripe
DPASCC
OpenAIUSA / EU
Purpose
AI processing
Data
Context of the specific request
DPASCCNo training
AnthropicUSA / EU
Purpose
AI processing (alternative)
Data
Context of the specific request
DPASCCNo training

We inform business customers of changes to subprocessors in advance on request.

AI data processing

PathHub AI currently uses language models from OpenAI; Anthropic is integrated as an alternative provider to which no data is currently transmitted. For each AI feature, only the context needed for that specific request is passed to the model.

  • Your content is not used to train public models.
  • Processing runs under the providers' business API terms, not consumer services.
  • No advertising profiles, no selling of data.

Security & access

Active
Role-based permissionsOwner, editor and viewer per workspace.
Active
Secure passwordsStored only as bcrypt hashes, never in plain text.
Active
Protection against password guessingFailed sign-in attempts are limited.
Active
Session expiryAfter 2 hours, or after 30 days with “stay signed in”.
Active
LoggingSign-in attempts and API access are recorded.
Active
API with permissionsAPI keys with read, write and AI scopes, rate limits and HMAC-signed webhooks.
In preparation
Two-factor authenticationExtra protection at sign-in.
On request
IP restrictionsLimit access to approved networks, for Enterprise.

Evidence & documentation

We document our measures and provide your privacy and procurement team with everything needed for their review.

Active
Data center ISO 27001Our hosting data center in Germany is ISO 27001-certified.
Active
Security testingAutomated tests against common attacks on the app and interfaces.
Active
TOMs & records of processingTechnical and organisational measures under Art. 32 GDPR, documented and available on request.
On request
Security questionnairesWe answer your company's privacy and security questionnaires.

Your rights & data processing

For business customers we provide a data processing agreement (DPA) including EU Standard Contractual Clauses.

AccessWhich data we store about you.
RectificationHave incorrect data corrected.
DeletionOn account deletion, your project data is removed from live systems; backups expire after their retention period.
ExportExport plans as PDF, Excel or Markdown, or retrieve them via the API.

Full details: Privacy policy · Security

Frequently asked questions

Is PathHub AI GDPR-compliant?

Yes. PathHub AI processes data under the GDPR: hosting in Germany, a data processing agreement for business customers and contractually safeguarded subprocessors that are disclosed on this page.

Where is my data stored?

Project data is stored in a database on servers in Germany (Hetzner, Falkenstein). For individual tasks such as AI processing or sending emails, we use the subprocessors listed above.

Is my data used to train AI?

No. Your content is not used to train public models. The AI providers only process the context of the specific request under their business API terms.

Can I get a DPA?

Yes. Business customers receive a data processing agreement including EU Standard Contractual Clauses. Contact security@pathhub.ai.

Do you document your technical and organisational measures (TOMs)?

Yes. Our TOMs under Art. 32 GDPR cover physical, system and data access control, encryption, availability and deletion. You receive them together with the DPA via security@pathhub.ai.

What happens when I delete my account?

Your project data is removed from live systems. Backups expire automatically after their retention period.

Questions about privacy or security?

For a DPA, our TOMs, records of processing or your company's security questionnaire, get in touch.

security@pathhub.ai