Where is our data stored?

In Germany. Operation and storage take place in Germany; transfer and storage are encrypted.

Is there a data processing agreement?

Yes. We provide the DPA as part of the enterprise licence.

How do we add and remove staff?

Through workspace management: invite, assign a role, remove at any time. Sessions can be ended centrally.

Is there an audit log?

Yes. Every submission has an activity log with person and timestamp; file uploads and deletions appear in the file history, optionally with SHA-256 proof.

On request for larger rollouts as part of the enterprise licence.

Yes. API and MCP connection are part of the Enterprise plan. Webhooks and custom interfaces are available on request.

How do we get our data at contract end?

PDF export individually or in bulk, export of master databases – at any time, also before contract end.

What happens to our data in the AI?

Hero AI Assistant and Hero Agent only work with the data in your workspace. Agent memory is viewable and deletable; sensitive actions are tied to approval.

Who accompanies the rollout?

A personal contact. Onboarding, pilot and training are included in the enterprise licence.

How fast does support respond?

Enterprise customers receive support with agreed response times. The specific times are stated in the quote.

Security & data protection

Hosted in Germany

Your inspection data. In Germany. Under your control.

Name: ProtocolHero
Brand: ProtocolHero

This page answers the questions procurement, IT and data protection officers ask before a rollout – concise and without marketing. Anything missing here, we clarify in the pilot call.

For businesses

Hosting and data location

ProtocolHero is operated in Germany. Your protocols, files and documents are stored in Germany.

Encrypted transfer (TLS) between your devices and ProtocolHero
Encrypted storage of files and documents

Data protection

Processing follows the GDPR. For enterprise customers we provide the data processing agreement as part of the enterprise licence.

Data processing agreement (DPA) for enterprise customers
List of sub-processors on request
Deletion of your data at contract end after export

Access and roles

You define per workspace who may see and change what. Add and remove users at any time.

Roles and permissions per workspace
Device limits per plan, sessions can be ended centrally
Hero Agent gets its own role – never owner, never more rights than the person asking

Traceability

Every action on a submission is logged with person and time – from upload to approval.

Activity log per submission: assignment, review, approval, signature, file upload
File history with optional SHA-256 proof in the audit log
Support access to customer accounts is logged internally and traceable

Share links

Shared submissions and fill-in links for subcontractors are precisely controllable.

Password protection and expiry date per link
Share view only or fill-in only
Any link can be deactivated at any time

AI and Hero Agent

Hero AI Assistant and Hero Agent work exclusively with the data in your workspace.

Agent memory is viewable, searchable and deletable
Caution mode: sensitive actions only after approval by your staff
Access list per agent – only designated people may issue commands

Data export

Your protocols belong to you. Take them out at any time – no questions asked.

PDF export individually or in bulk
Export of master databases
API and MCP connection on the Enterprise plan

Offline and operation

ProtocolHero keeps working without signal: staff document offline, synchronisation follows automatically.

Offline use in app and web
Installable app, desktop app and web – one data set
Support with response times as part of the enterprise licence

For the questionnaire

Short answers for procurement and IT

The questions businesses ask us most often before a rollout – answered in one sentence.

Where is our data stored?: In Germany. Operation and storage take place in Germany; transfer and storage are encrypted.
Is there a data processing agreement?: Yes. We provide the DPA as part of the enterprise licence.
How do we add and remove staff?: Through workspace management: invite, assign a role, remove at any time. Sessions can be ended centrally.
Is there an audit log?: Yes. Every submission has an activity log with person and timestamp; file uploads and deletions appear in the file history, optionally with SHA-256 proof.
Do you support SSO?: On request for larger rollouts as part of the enterprise licence.
Is there an API?: Yes. API and MCP connection are part of the Enterprise plan. Webhooks and custom interfaces are available on request.
How do we get our data at contract end?: PDF export individually or in bulk, export of master databases – at any time, also before contract end.
What happens to our data in the AI?: Hero AI Assistant and Hero Agent only work with the data in your workspace. Agent memory is viewable and deletable; sensitive actions are tied to approval.
Who accompanies the rollout?: A personal contact. Onboarding, pilot and training are included in the enterprise licence.
How fast does support respond?: Enterprise customers receive support with agreed response times. The specific times are stated in the quote.

On request for larger rollouts

For several sites and your own IT

For businesses with several sites or their own IT landscape we provide these building blocks as part of the enterprise licence. Ask us in the pilot call.

Single sign-on with your identity provider
Custom data retention and export formats
Extended support and availability commitments
Webhooks and custom interfaces to ERP, trade software and BI
Your procurement security questionnaire – we answer it in writing

Security questions from procurement or IT?

We answer them in the pilot call – or in writing on your questionnaire. 20 minutes, concrete answers.

For businesses