This statement summarises the security posture of Capptions B.V. and applies to all Capptions products: Capptions One, Capptions Direct, the Capptions Direct Marketplace, Capptions AI and Seveso.app.
- Version: 2026.2
- Last updated: 14 September 2026
- Security contact: security@capptions.com
- Responsible disclosure: see Section 10.
1. Certifications
- ISO/IEC 27001 — certified since April 2022. The current certificate and Statement of Applicability are available under NDA on request.
- SOC 2 Type II — attested since June 2023, renewed annually. The latest report is available under NDA on request.
Both certifications cover the Information Security Management System that supports every Capptions product.
2. Hosting and data residency
- Primary production runs on Hetzner cloud infrastructure in Germany, primarily in the Nuremberg datacentre, on a redundant Kubernetes (k3s) cluster. The primary application databases (MongoDB 3-node replica set, Redis, OpenSearch) and the object storage backing Kubernetes persistent volumes also run on Hetzner.
- Specific ancillary services run on Amazon Web Services (AWS) in Dublin, Ireland (eu-west-1): object storage for uploaded media and documents (S3), transactional email (SES), notifications (SNS), CDN (CloudFront, serving cdn.capptions.com and download.capptions.com) and the container image registry (ECR).
- Cloudflare, Inc. provides DNS, CDN, DDoS protection and a web application firewall in front of our services, with EU edge locations preferred on its global anycast network.
- All processing of Customer Data remains within the EU/EEA. Ancillary tools that may incidentally see metadata (e.g. billing, marketing) are listed on the Sub-processors page and covered by the transfer mechanisms in Section 3 of the Privacy Statement.
- Capptions inherits the physical, environmental and platform certifications of Hetzner, AWS and Cloudflare for the layers those providers operate.
3. Tenant isolation
Capptions is multi-tenant SaaS. An intelligent tenant segregation layer keeps each customer’s data logically separated. Every request carries a tenant identifier that is verified server-side, and administrative access to customer data is restricted to a small named group of Capptions staff on the principle of least privilege.
4. Encryption
- In transit: TLS with strong cipher suites enforced on all traffic to, from and between Capptions services and micro-services. Automated email notifications are sent with TLS where the receiver supports it; S/MIME can be configured on a case-by-case basis.
- At rest: AES-256 for databases, object storage and backups.
- Backups are stored and transmitted encrypted at all times.
5. Identity and access
- Customer access: username + password with a strong default password policy, an optional and recommended stricter customer-defined policy, and Multi-Factor Authentication. Enterprise customers can enable SAML 2.0 / OIDC single sign-on. Passwords are stored hashed and salted; account access is logged, tracked and audited.
- Capptions employee access to production systems follows least privilege, is limited to a small named group, is logged centrally and is reviewed periodically. Segregation of duties applies to system administration and change approval.
6. Application and system security
- Formal change management process. All changes to the production environment (network, systems, platform, application, configuration) are tracked, tested in separate environments and reviewed before deployment. Testing other than deployment validation is prohibited in production.
- Secure SDLC with security and QA embedded throughout the lifecycle; security best practices are mandated for all development activities.
- Enterprise-grade automated security management protects against malicious actors, brute-force attacks, cross-site request forgery, DDoS and common injection attacks (OWASP Top 10).
- Operating systems are hardened to industry best practice, patched, and stripped of unnecessary users, services and components.
7. Logging and monitoring
- Better Stack provides centralised log management for application and infrastructure logs shipped from the whole Kubernetes cluster, uptime monitoring, and 24/7 alerting with on-call escalation through its incident management. Better Stack also receives application error reports; error tracking ingests in Frankfurt, Germany, with the data region configured as Germany.
- Error monitoring for the Go-based media and audit services, and for the legacy white-label mobile apps and legacy web client, is handled by Sentry in its EU region.
- Service availability across all three product lines is published on our public status page at https://status.capptions.com.
- Audit logs cover authentication, configuration changes and access to Customer Data.
8. Backups and business continuity
- Customer data is stored in fully redundant databases and backed up on a scheduled basis, stored separately from the production systems.
- Capptions’ architecture uses redundancy at the application and cluster level, including multiple application replicas and cluster nodes behind a load balancer.
- A documented Business Continuity Plan and Disaster Recovery Plan prioritise the functions critical to service delivery; scope reflects criticality per function.
9. Incident response and breach notification
- Capptions maintains a documented Security Incident Response Process (SIRP) with severity classification, defined investigation and diagnosis workflow, documentation and reporting requirements, and escalation paths.
- Incidents affecting customers are escalated to the relevant Account Manager for customer notification. Critical issues are remediated immediately.
- For personal data breaches affecting Customer Data, Capptions notifies the affected Controller without undue delay as required by Article 33 GDPR. See the Data Processing Agreement Section 5.
10. Vulnerability disclosure
We welcome reports from security researchers. Send findings to security@capptions.com with reproduction steps. Please:
- give us a reasonable time to remediate;
- avoid privacy violations, service disruption and data destruction;
- avoid testing against accounts you do not own — request a test tenant instead.
We do not currently operate a paid bug bounty but recognise researchers who make significant disclosures.
11. Personnel security
- Background checks for employees at time of employment, where permitted by local law.
- Information security responsibilities documented in the Information Security & Access Policy, which every employee signs during onboarding.
- Mandatory annual security and privacy training. Additional training for employees who handle customer data.
- Formal termination process removes access to Capptions systems and data and reminds ex-employees of continuing obligations.