Skip to content

Data and security

This page describes how CORTELA OS handles the data of the businesses that work with it. It summarises our contract documents: the data processing agreement, the technical and organisational measures and the list of sub-processors. The contract is what is binding.

At the end you will find what we explicitly do not promise.

Where the data is stored

Database, sign-in and file storage run at Supabase in its Frankfurt am Main data centre (AWS region eu-central-1). STRATO serves the website and the application from Germany.

Supabase, Inc. is a company based in the USA. The data is processed in the EU region Frankfurt.

So the data does not sit on a computer at CORTELA but with the provider. It exists independently of CORTELA.

Who processes the data

These service providers process data on our behalf:

  • Supabase, Inc. Database, sign-in, file storage, server functions. Frankfurt am Main (EU).
  • STRATO AG Hosting of website and application, email sending, mailbox. Germany.
  • Mistral AI SAS AI functions: assistance, transcription, reading order documents. France (EU).
  • Cal.com, Inc. Appointment booking. USA. Linked only, not embedded on cortela.de.
  • Production and shipping partners Manufacturing, decoration, finishing and shipping, per order. Germany and EU.

Data processing agreements are in place with Supabase, STRATO and Cal.com. For Mistral, its data processing agreement applies as part of its terms of use. Production and shipping partners only receive the data they need for the order in question.

If a service provider is to be added or replaced, we inform our customers in advance in text form.

How the data is protected

  • Separation of businesses. Every record carries the identifier of its business. Access rules inside the database itself make sure a business only sees its own data, even if someone bypasses the interface. All businesses share one database; separation happens through these rules, not through separate instances.
  • Measured, not claimed. On 10 October 2026, all 178 tables of the application had access rules enabled. A test run against every single table checks that anonymous access is actually rejected.
  • Sign-in. Personal accounts, no shared logins. Passwords are stored only as a hash. There is no self-registration; accounts are created by invitation only. Two-factor sign-in via an app is available; once set up for an account, the database requires it for every access.
  • Permissions. Permissions depend on the profile stored on the server, never on details someone can set themselves. Production partners only see the orders they carry out, without costing and without customer details.
  • Encryption. All connections are encrypted (TLS). Stored data is encrypted by the data centres. Our own backups are additionally encrypted with AES-256.
  • Backups. Database and file storage are usually backed up automatically every day. Each backup is read back in the same run. We rehearsed a full restore on 14 August 2026.
  • Checks. Checks are done by test programs, not by assurance: among other things, whether anonymous access is rejected, whether purchase prices stay out of the delivered program and what is reachable without signing in.

Export and deletion

A business can request a complete export of its data at any time, not only when the contract ends.

Admins trigger it themselves in the application: Admin → Privacy requests → “Export all data”. The result is a ZIP file containing every table of the business as CSV and as JSON. Access keys and secret link identifiers are not included. CORTELA provides the related files (print files, documents, attachments) in their original form on request.

The export covers all data of the business, not only personal data: customers and contacts, orders and line items, quotes, invoices and other documents, approvals with their history, price and terms lists and the settings. It does not contain data of other businesses or CORTELA’s system defaults such as the textile catalogue, help texts and program code.

When the contract ends, we provide the export without being asked and without separate charge. After that the data is deleted. Anything that must be retained by law, such as invoices, is blocked until the end of the retention period instead of deleted.

Requests from data subjects (access, erasure, rectification and others) are recorded by each business in its own register in the application, with deadline and reminder. Erasure requests are carried out by anonymisation.

If CORTELA drops out

CORTELA is a sole proprietorship. If the owner drops out permanently, nobody can continue running the software as a stand-in.

What still holds: the data is stored at Supabase in Frankfurt and therefore exists independently of CORTELA. Anyone who pulls the export regularly does not depend on an outage.

What we do not promise

  • An availability guarantee (no SLA).
  • A fixed response time in case of disruptions.
  • Continuation of the business by third parties.

Also: an additional backup by the platform provider does not exist at the moment; it is planned with the first paying business. Two-factor sign-in is not mandatory for every account. We do not hold a certification such as ISO 27001.

Contact

Questions about data and security are answered by Jan Keur directly: merch@cortela.de.

How we handle data on this website is described in the privacy policy (German). Provider details: legal notice (German).

Last updated: 12 October 2026. We update this page when service providers or measures change.