Security and privacy

Your mail is confidential. This page lists what we do to keep it that way — only what our code and operations show, and no promise beyond that.

Where your data is stored

The application, the database and the scans run on our own server at Hetzner Online GmbH in a data centre in Helsinki, Finland (EU).
Encrypted backup copies are kept on a computer in Germany that a shareholder of Postuvio UG operates for us, and at Hetzner in the EU.
Summaries, deadlines and translations are produced by the Claude model via Amazon Bedrock (Amazon Web Services EMEA SARL, Luxembourg); requests go to a data centre in Frankfurt am Main and are processed only in data centres in the EU. Letter contents are not used to train AI models.

No strangers on this website

This website runs no third-party scripts: no Google Analytics, no tag manager, no advertising pixels.
We count visitors ourselves on our own server: without cookies, without storing anything in your browser and without storing your IP address or browser signature.
We only set a cookie for attribution if you agree in the banner. You can change that at any time under “Cookie settings” at the bottom of every page.

Encrypted in transit

Every connection between your browser and us uses TLS (HTTPS), enforced by HSTS.
We only send the summary and the scan by e-mail if you chose that yourself in your account. Otherwise you only receive a notice that mail has arrived.

Who can see your mail

In your account, your letters can only be retrieved after signing in. A link to a single scan only exists if you create it yourself — when forwarding a letter to your tax adviser or via the letter API; it covers only that letter and expires.
Every account is separated from all others in the database (row-level security). Another account cannot retrieve your letters.
Operators and customers have separate roles: only an operator login reaches the operator area.
Until a letter is assigned to your account, our staff see the scan and the recognised text as far as needed to assign it. After that, nobody on our side sees the content — except in an emergency: with a reason, for that one letter only and for 15 minutes, logged, and you receive an e-mail straight away.
We only process the content of a letter once your signed authorisation to receive mail is in place. Without it we only see the envelope.
Two-factor login with an authenticator app: mandatory in the operator area, and available for your customer account at any time in the settings.

Paper and retention

We keep paper originals locked away for 90 days and then destroy them with a shredder, unless you ask us to forward them.
Visitor counts are deleted after 13 months.

Contracts and law

Business customers conclude the data processing agreement under Art. 28 GDPR when they register. It is published on our website; on request we send you a copy for your records.
PortoDoc is run by a German company; German law and the GDPR apply.

What happens after you cancel

After the contract ends, your account stays read-only for three months: you can view and download your letters. Then we delete them; we remind you by e-mail 30 and 7 days before.
This is what our terms (§ 9) and our privacy policy (no. 12) say. You can also trigger the deletion earlier yourself in your account.

What we do not claim

So you know where you stand:

We hold no certification under a security standard and no audit report by a third party.
The scans stored on the server are not additionally encrypted. Protection lies in access: login, roles, tenant separation.
There is no access log you can view yourself yet. Our scans are not certified under any standard.

Sources and legal basis

Last checked on 3 November 2026 · How we check our information

The information on this page comes from our privacy policy, our terms and our day-to-day operations. If something changes, we change these texts first.

Questions about security?

Write to us — we answer personally.