ProtocolHero
Security & data protection
Hosted in Germany

Your inspection data. In Germany. Under your control.

This page answers the questions procurement, IT and data protection officers ask before a rollout – concise and without marketing. Anything missing here, we clarify in the pilot call.

For businesses

Hosting and data location

ProtocolHero is operated in Germany – on servers in Frankfurt. Your protocols, files and documents are stored in Germany.

  • Servers in Frankfurt am Main
  • Encrypted transfer (TLS) between your devices and ProtocolHero
  • Encrypted storage of files and documents

Data protection

Processing follows the GDPR. Every customer who needs them receives a data processing agreement (DPA) and our technical and organisational measures (TOMs) from us.

  • DPA and TOMs for every customer on request
  • List of sub-processors on request
  • Deletion of your data at contract end after export

Access and roles

You define per workspace who may see and change what. Add and remove users at any time.

  • Roles and permissions per workspace
  • Two-factor sign-in, can be made mandatory for the whole team
  • Device limits per plan, sessions can be ended centrally
  • Hero Agent gets its own role – never owner, never more rights than the person asking

Traceability

Every action on a submission is logged with person and time – from upload to approval.

  • Activity log per submission: assignment, review, approval, signature, file upload
  • File history with optional SHA-256 proof in the audit log
  • Support access to customer accounts is logged internally and traceable

Share links

Shared submissions and fill-in links for subcontractors are precisely controllable.

  • Password protection and expiry date per link
  • Share view only or fill-in only
  • Any link can be deactivated at any time

AI and Hero Agent

Hero AI Assistant and Hero Agent work exclusively with the data in your workspace. AI processing takes place in the EU.

  • AI processing in the EU
  • Agent memory is viewable, searchable and deletable
  • Caution mode: sensitive actions only after approval by your staff
  • Access list per agent – only designated people may issue commands

Data export

Your protocols belong to you. Take them out at any time – no questions asked.

  • PDF export individually or in bulk
  • Export of master databases
  • API and MCP connection on the Enterprise plan

Offline and operation

ProtocolHero keeps working without signal: staff document offline, synchronisation follows automatically.

  • Offline use in app and web
  • Installable app, desktop app and web – one data set
  • Support with response times as part of the enterprise licence
For the questionnaire

Short answers for procurement and IT

The questions businesses ask us most often before a rollout – answered in one sentence.

Where is our data stored?
In Germany. Operation and storage take place on servers in Frankfurt; transfer and storage are encrypted.
Is there a data processing agreement?
Yes. Every customer receives a DPA and our technical and organisational measures (TOMs) on request.
Is there two-factor sign-in?
Yes. It can be made mandatory for the whole team.
How do we add and remove staff?
Through workspace management: invite, assign a role, remove at any time. Sessions can be ended centrally.
Is there an audit log?
Yes. Every submission has an activity log with person and timestamp; file uploads and deletions appear in the file history, optionally with SHA-256 proof.
Do you support SSO?
On request for larger rollouts as part of the enterprise licence.
Is there an API?
Yes. API and MCP connection are part of the Enterprise plan. Webhooks and custom interfaces are available on request.
How do we get our data at contract end?
PDF export individually or in bulk, export of master databases – at any time, also before contract end.
What happens to our data in the AI?
Hero AI Assistant and Hero Agent only work with the data in your workspace; AI processing takes place in the EU. Agent memory is viewable and deletable; sensitive actions are tied to approval.
Who accompanies the rollout?
A personal contact. Onboarding, pilot and training are included in the enterprise licence.
How fast does support respond?
Enterprise customers receive support with agreed response times. The specific times are stated in the quote.
On request for larger rollouts

For several sites and your own IT

For businesses with several sites or their own IT landscape we provide these building blocks as part of the enterprise licence. Ask us in the pilot call.

  • Single sign-on with your identity provider
  • Custom data retention and export formats
  • Extended support and availability commitments
  • Webhooks and custom interfaces to ERP, trade software and BI
  • Your procurement security questionnaire – we answer it in writing

Security questions from procurement or IT?

We answer them in the pilot call – or in writing on your questionnaire. 20 minutes, concrete answers.

For businesses