This page covers the Seveso.app specifics on top of our cross-product Security Statement.
- Version: 2026.1
- Last updated: 15 July 2026
- Security contact: security@capptions.com
1. Where your data lives
Seveso.app runs on the same EU-only Capptions infrastructure as the rest of the platform:
- Application, database, files, logs and audit trail are hosted on Hetzner Online GmbH, in Germany (primarily Nuremberg), with specific ancillary services (media/document storage, transactional email, notifications, CDN, container registry) on Amazon Web Services (AWS) in Dublin, Ireland.
- Cloudflare, Inc. provides DNS, CDN, DDoS protection and a web application firewall in front of the platform.
- AI inference for Seveso.app is routed to EU regions of our AI sub-processors — see the AI Policy and the current Sub-processors list.
No Seveso.app Customer Data is stored or processed outside the EEA. Ancillary tools that may incidentally see metadata (e.g. billing, marketing) are listed on the Sub-processors page.
2. Certifications
- ISO/IEC 27001 — certified since April 2022.
- SOC 2 Type II — attested since June 2023, renewed annually.
Certificate and report available under NDA on request.
3. Tenant isolation
- Logical tenant segregation across databases and object storage.
- Tenant identifier verified server-side on every request, including every AI call.
- AI retrieval and any vector indexes are scoped per tenant so prompts cannot include data from another tenant.
4. Encryption, identity, monitoring, backups
See the Security Statement for the cross-product controls (TLS in transit, AES-256 at rest, MFA, audit logging, 24×7 monitoring, redundant backups replicated to a geographically separated location).
For Seveso.app specifically:
- SAML 2.0 / OIDC single sign-on is available on Seveso.app plans, so operators do not have to run safety-critical systems without enterprise IAM.
- Additional Enterprise controls (extended audit-log retention, additional key management options) are available on request.
5. Availability and disaster recovery
- Production availability target: 99.9 % monthly uptime, measured at the application edge.
- Business continuity and disaster recovery plans prioritise the functions critical to service delivery; recovery objectives and tested procedures are shared with Enterprise customers under NDA on request.
- Backups are encrypted at rest and in transit and replicated to a geographically separated EU location; restoration is tested regularly.
6. Incident notification
For personal data incidents affecting Seveso.app Customer Data, Capptions notifies the affected Controller without undue delay as required by Article 33 GDPR. For incidents classified as significant under NIS2, Capptions supports the customer’s notification obligations to the competent authority within the statutory timelines.
7. Right to audit
Enterprise customers may audit Capptions as set out in the Data Processing Agreement Section 8. For most customers the ISO/IEC 27001 certificate, the SOC 2 Type II report and a completed security questionnaire satisfy due diligence.