Five questions worth asking every vendor on your shortlist
Including us. Our answers are below, awkward ones first, because you would find them anyway and finding them here is faster for both of us.
The nine questions, answered in one place
These are the questions a procurement or data-protection review asks every supplier, in roughly this order. Three of the nine answers below are a plain no. They are also the three most useful lines on this page, because a supplier who answers all nine with a yes is either larger than us or is guessing, and you will find out which one during the audit rather than before it. Three more are answered by the data processing agreement: the agreement itself, incident notification and deletion at the end.
| What a review asks | The answer today | Where to check it |
|---|---|---|
| Is the processor itself ISO 27001 certified? | No. The data centre is. The company itself does not hold a certification today. | Certification |
| Who are the sub-processors, and where do they sit? | Named, with location and what each one touches. | Sub-processors |
| Is there an Article 28 data processing agreement? | Yes. For anonym.legal it is self-service: you enter your e-mail address and your organisation’s details, and the signed agreement arrives by e-mail. It is in English, version en-v1. For anonym.plus and our implementation work it is agreed case by case, signed and returned within two working days of the request. | Data processing agreement |
| Is there a third-party penetration test or audit report? | No. None has been commissioned. Saying otherwise is the single easiest claim to disprove in this industry. | Document processing in anonym.plus keeps our infrastructure out of your path |
| Is there an uptime SLA on the hosted service? | No. No service level is offered or implied. | Once activated, document processing in anonym.plus depends on no service of ours |
| What is the incident notification process? | Contractual. The data processing agreement requires anonym.legal to notify you without undue delay and, where reasonably feasible, within 48 hours of becoming aware of a breach, with, as far as available, its nature, the people and records affected, the likely consequences and the measures taken (clauses 11.2 and 11.3). | Data processing agreement |
| What is the liability position? | In the published terms of service, including the limitations. It is not hidden in an order form. | Terms of service |
| What happens to us if you disappear? | Local: the licence is perpetual and the installation keeps working, with no server of ours in the path. Hosted: the service stops. When the contract ends, the data processing agreement requires anonym.legal to return or delete your personal data, at your choice and on your written request, within 30 days after the service ends (clauses 15.1 and 15.2, with their exceptions: statutory retention, another agreement, ordinary deletion cycles); copies in backups are deleted with the ordinary backup rotation (15.3). | anonym.plus · Data processing agreement |
| Where is the text actually processed? | Documents: Hetzner, Falkenstein, Germany with anonym.legal. The optional AI-assisted rule creation sends the description and the examples you type to OpenAI in the USA. On your own hardware with anonym.plus, and processing makes no network call. | Security |
This table is the honest state on September 27, 2026. When one of the three noes becomes a yes it changes here first, not in a sales conversation.
Written precisely enough to survive your auditor
Processing on the hosted platform takes place at Hetzner Online GmbH in Falkenstein, Germany. That facility holds ISO/IEC 27001 certification, covering the physical and operational security of the data centre.
The precision that matters. The certificate covers the facility, not this company. Vendors routinely write “ISO 27001 certified” without naming Hetzner — or whichever data centre actually holds it — and let the reader infer the rest. It reads well until an auditor checks the register, does not find the vendor listed, and the evaluation stops — not because the security was inadequate, but because the sentence was.
So here is the sentence, scoped correctly:
Processing takes place at Hetzner Online GmbH, Falkenstein, Germany. The facility holds ISO/IEC 27001 certification. The processor, Voltage Brothers Infrastruktur UG (haftungsbeschränkt), does not itself hold ISO/IEC 27001. The technical and organisational measures it applies are described at anonymize.solutions/evidence.html#tom.
Where this is going. The company itself does not hold a certification today. We are not publishing a target date, because a missed certification date is worse than no date at all — it is the one promise a buyer will check.
If your framework requires a certified processor today with no exceptions, that is a real constraint and we will not talk you out of it. The route that still works is anonym.plus: processing on hardware inside a boundary you have already certified yourself.
Mechanisms, per product and per data flow
There is no single security statement that is true of both products, because one sends text over a network and the other does not.
anonym.legal — hosted
- Transport secured with TLS
- Encryption keys are derived on your device with Argon2id; custom patterns you store are encrypted in your browser, and the server keeps only ciphertext
- Text is processed in memory and not used for training. It is stored, encrypted, only if you turn on history, or as a token mapping for reversible anonymization (24 hours by default, up to 30 days if you choose persistent)
- The sign-in is not Zero-Knowledge: the password is still sent at sign-in today.
- The reversible-encryption operator uses AES in CBC mode without an authentication tag, and its key reaches the server, which sees the plaintext during that operation. “Zero-Knowledge” does not extend to it.
anonym.plus — local
- No transport surface for documents — processing makes no network call to intercept. What does go online: the one-time activation, an update check (on by default, can be switched off), the updates you choose to install, a check for new language models at start and the models you choose to download
- Document content never reaches our servers, so there is none for a third party to request from us. Licence purchase and activation do create an account and machine record on our licensing server
- The macOS build is not notarised; Gatekeeper blocks a plain download until the user allows it, and an earlier vault-setup defect on macOS is not yet confirmed fixed
- Batch processing only from the Pro tier; no CLI or webhook surface
We publish no third-party penetration test or audit report, and no detection accuracy percentage. Both would be easy to imply and neither would survive the question “can I see it?”
Who else touches the data
For anonym.legal the list is Annex 2 of its data processing agreement, as of 26 August 2026; additions or replacements that materially affect the processing are announced in advance (clause 12.5). For this website it is our own privacy notice. A processor missing here is missing there too; we have checked nothing beyond those two documents.
| Processor | What it does | Where |
|---|---|---|
| Hetzner Online GmbH | anonym.legal: hosting and processing. This website: hosting, fonts, server logs | Falkenstein, Germany |
| Google Ireland Limited (reCAPTCHA) | anonym.legal: bot and abuse protection at registration and in forms; IP address and interaction and device signals, no document content | Ireland; transfer to Google LLC, USA, possible (standard contractual clauses, EU-U.S. Data Privacy Framework) |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | anonym.legal: payments and subscriptions; name, e-mail address, plan and amount, in payment audit logs also IP address and user agent; no document content | Luxembourg, partly USA (standard contractual clauses, EU-U.S. Data Privacy Framework) |
| Twilio Inc. (SendGrid) | anonym.legal: e-mails for registration, two-factor sign-in and subscriptions; recipient address and message content | USA (standard contractual clauses, EU-U.S. Data Privacy Framework) |
| united-domains GmbH | anonym.legal: operational and alert e-mails from its servers | Germany |
| OpenAI, L.L.C. (default) | anonym.legal: optional AI-assisted rule creation. It receives the entity descriptions, examples or patterns you type, not the documents you anonymize. With your own API key you can use Anthropic, Abacus.AI or Google instead, and then contract with them directly | USA (standard contractual clauses, EU-U.S. Data Privacy Framework) |
| Microsoft 365 | This website: e-mail for messages sent to us | EU / US, EU-U.S. Data Privacy Framework and standard contractual clauses |
| Google reCAPTCHA | This website: spam check when the contact form is sent, only after consent. Google acts here as a separate controller, not as our processor | EU / US, EU-U.S. Data Privacy Framework |
This website’s privacy notice · anonym.legal’s privacy notice · anonym.legal’s data processing agreement.
How to get one signed
An agreement under Article 28 GDPR sets out what we may do with personal data you send us as a processor: subject matter and duration, nature and purpose, categories of data subject, your instructions, confidentiality, security measures, sub-processor rules, assistance with data-subject requests, deletion or return at the end, and audit rights.
For anonym.legal the contracting party is Voltage Brothers Infrastruktur UG (haftungsbeschränkt), Europaallee 6, 66113 Saarbrücken, Germany, acting under the brand anonym.legal. The agreement is self-service: you enter your e-mail address at anonym.legal, add your organisation’s details, and the signed agreement arrives by e-mail. It is currently available in English only (version en-v1).
What it commits to, clause by clause:
| Topic | What the agreement says | Clause |
|---|---|---|
| Use of your data | Only to provide the service. Not sold, not used for advertising profiles, not used to train AI models or improve products, and not passed to AI providers as part of standard anonymization | 8.1, 8.2, 8.4 |
| Personal data breach | Notification without undue delay and, where reasonably feasible, within 48 hours | 11.1, 11.2 |
| New sub-processors | Announced in advance where they materially affect the processing; you can object on reasonable data protection grounds within 14 calendar days of the notice, and if no solution is found you can terminate the affected services | 12.5, 12.6 |
| Transfers outside the EEA | Only with an adequacy decision, the EU standard contractual clauses or another lawful mechanism | 13 |
| Audits | Documentation on request; an audit at most once per calendar year, more often after a confirmed or reasonably suspected material security incident, at a supervisory authority’s request or with substantiated reason to believe anonym.legal is in material breach of the agreement | 14 |
| End of the contract | Return or deletion, at your choice and on written request, within 30 days after the service ends, except for statutory retention, another agreement and ordinary deletion cycles; copies in backups are deleted with the ordinary rotation | 15.1, 15.2, 15.3 |
| Law and courts | German law; German courts, unless mandatory data protection law provides otherwise | 18 |
anonym.plus and our implementation work: anonym.plus processes on your machines, so there is usually nothing for us to process on your behalf. Where our implementation work does involve personal data on your systems, we agree a data processing agreement for that case, signed and returned within two working days of the request.
What Annex 3 of the agreement lists
Article 32 GDPR requires security measures appropriate to the risk. These are the ones anonym.legal’s data processing agreement lists, grouped the way its Annex 3 groups them. The annex says they are reviewed periodically and adapted to the state of the art.
Confidentiality
- Documents are processed at Hetzner in Falkenstein, Germany, in a data centre certified to ISO/IEC 27001:2022. The providers outside the EU that Annex 2 names are listed under sub-processors, with what each one sees
- Role-based access and least privilege; access to content only on a need-to-know basis
- Individual user accounts and strong authentication for administrative access
- Physical security from the certified data-centre operator
Integrity
- TLS in transit; encryption at rest “where appropriate”, in the agreement’s own words, which is not a promise that everything is encrypted at rest
- The agreement states that clear-text matter content is not transferred to third countries
- Logging of security-relevant events
Availability
- Backup and restore procedures against accidental loss
- Redundancy and disaster recovery from the certified hosting provider
- Monitoring of availability and capacity
Regular review
- An information security management system following ISO/IEC 27001, without a certificate of its own; only the Hetzner infrastructure is certified (certification)
- Vulnerability management and patching; incident procedures, including detecting a breach and notifying you
- Own staff bound to confidentiality; sub-processors bound through their own agreements
- Data minimisation and purpose limitation; return or deletion at the end
What the agreement says about privilege
For law firms, tax advisers, auditors and medical practices this is usually the first question. Here is the exact scope, including what is not in it.
Clause 9 of the data processing agreement recognises that you may be a law firm or another regulated profession, and that what you send may be covered by legal professional privilege, professional secrecy or an equivalent duty. For that information anonym.legal commits to:
- treat it as strictly confidential and process it only to provide the service
- restrict access to personnel with a strict operational need to know
- bind every authorised sub-processor that receives it to equivalent confidentiality
- disclose it only on your documented instructions, to authorised sub-processors, or where the law requires it (9.3)
- tell you before a legally compelled disclosure, unless the law forbids that, so you can seek protective measures (9.4)
Where you are bound by professional secrecy, clause 9.5 says anonym.legal is available to discuss supplementary confidentiality arrangements; details and availability on request.
The standard DPA contains no confidentiality undertaking under § 203(4) StGB or § 43e BRAO. If your professional duties require one, ask before you sign.
Ask the sixth question
If something here sounds too convenient, that is the thing worth asking about. We would rather answer now than have it surface in your review.