AVV — Auftragsverarbeitungsvertrag

Full document

The full, legally binding AVV is in the project repository:

Read the full AVV on GitHub

Format: Markdown · License: CC-BY-SA-4.0 (re-use the structure freely)

Public summary

The following table summarises the AVV's most important points. For full details, see the GitHub document.

§ 1 — Verantwortlicher (Controller)

§ 2 — Auftragsverarbeiter (Processor)

The relay server is operated on a single-tenant VPS leased from Hetzner Online GmbH, a German provider with ISO 27001 / ISO 27017 / ISO 27018 / PCI-DSS certifications. Data resides in the FSN1 (Falkenstein) and NBG1 (Nuremberg) data centres, in Germany.

Hetzner acts as Unterauftragsverarbeiter (Sub-Processor) under the same Art. 28 obligations. The Hetzner AVV is countersigned and is available under NDA on request to privacy@securechat.team.

§ 3 — Subject matter and duration

Hosting and operating the SecureChat relay, which stores and forwards opaque, client-encrypted, client-signed message envelopes between two devices whose operators have exchanged a peer ID. The relationship begins on install and ends 30 days after uninstall + data-deletion request.

§ 4 — Nature and purpose

Processing is limited to what is strictly necessary to operate the SecureChat service:

• Envelope relay (sealed, client-encrypted, client-signed)
• Tombstone recording (delivery confirmation)
• Bearer-token-gated admin endpoint (audit-logged)
• Server log rotation (14-day retention)

The processor will not decrypt any envelope, classify message contents, correlate metadata across users, combine SecureChat data with any other data set, or disclose sealed envelopes to any third party without a binding legal order.

§ 5 — Data subject categories

• SecureChat users (sender + recipient)
• Visitors of securechat.team (marketing pages)
• TestFlight beta testers (Apple processes standard TestFlight metadata)

The processor does not collect any data from minors. Age rating 17+ is enforced by Apple's TestFlight / App Store.

§ 6 — Categories of personal data

Data the processor NEVER collects: plaintext message contents, Curve25519 private keys, contact lists, phone numbers, email addresses, names, location, microphone, camera, photos, account credentials, financial data, IDFA, advertising identifiers, crash reports, analytics events, behavioural or cross-app tracking data.

§ 7 — Processor obligations

1. Process only on documented controller instructions.
2. Personnel under confidentiality obligation.
3. Implement Art. 32 technical and organisational measures (non-root container, TLS 1.3 only, sealed-envelope-only, 14-day log rotation, audit-logged admin).
4. Engage sub-processors only with prior written authorisation (current list at /sub-processors.html).
5. Assist with data-subject rights (Art. 15-21 DSGVO).
6. Delete or return data after termination.
7. Make available all information necessary to demonstrate compliance and allow audits.

§ 8 — Deletion

After uninstall + deletion request, the controller will:

• Delete all sealed envelopes (within 24 hours TTL by design).
• Delete all tombstones associated with deleted peer IDs (within 30 days).
• Delete all server log entries older than 14 days (automated).
• Confirm the deletion in writing within 30 days.

No backup retention. SecureChat does not keep offline backups of envelope or tombstone data.

§ 9 — Incident notification (Art. 33 DSGVO)

The processor will notify the controller within 24 hours of becoming aware of a personal data breach. The controller will notify the competent supervisory authority within 72 hours where the breach is likely to result in a risk to the rights and freedoms of natural persons. Affected users are informed per the transparency policy (§ 11) where legally permitted.

A detailed incident-response playbook is in docs/INCIDENT-RESPONSE.md.

§ 10 — Sub-processor list

Current sub-processors:

New sub-processors are announced at least 30 days in advance on the status page. Data subjects may object (Art. 21 DSGVO) by self-hosting the relay.

§ 11 — Transparency and disclosure policy

The processor publishes an annual transparency report on the status page:

• Number of government data requests received and the response given (in jurisdictions where publication is legal).
• Number of data-deletion requests fulfilled and the average response time.
• Number of personal-data breaches (if any) and their resolution.

The processor will resist, in court if necessary, any government request to disclose sealed envelopes, on the basis that the relay holds no plaintext and disclosure cannot provide the plaintext content of a message. Where metadata disclosure is compelled by a binding legal order, the processor will challenge the order on proportionality grounds, notify affected users in advance if legally permitted, and publish the request in the next transparency report.

§ 13 — Changes to this AVV

Material changes are announced:

• On the status page at least 30 days in advance.
• In the iOS SecureChat app on next launch.
• Via a CHANGELOG entry in the public GitHub repository.

In case of conflict between this document and the Standardvertragsklauseln (Decision (EU) 2021/915), the Standardvertragsklauseln take precedence.