Overview
Security and data protection at Zuuna
Hosting in Germany, three external providers, enforced 2FA on every plan — and what Zuuna deliberately does not claim: no ISO 27001, no SOC 2.
Last updated:
This page answers the questions that come up in every data-protection review before a B2B contract: Where does the data live? Who else processes it? Which controls exist — and which do not? Short and verifiable: what is written here holds. What is not written here, we do not claim. For the bigger picture of what GDPR compliance means for a project management tool, see GDPR-compliant project management.
Where your data lives
Zuuna runs on our own servers in Germany. No external hosting provider, no US hyperscaler, no “EU region” of an American cloud. Your boards, cards, comments and attachments are stored in Germany and processed in Germany.
Only two operations run through external providers, and both are in the subprocessor table below: email delivery (mailbox.org, Berlin) and payment processing (PayPal, Luxembourg). Nothing else.
Data processing agreement (DPA)
For company use you need a data processing agreement under Art. 28 GDPR. Ours is public: you find it at /en/dpa — complete, no form, no sales call. You can read it before you sign up. It is the binding document for the subject and duration of processing, the technical and organisational measures, and the subprocessors in use.
We deliberately do not repeat the contract text here — the document is what binds, not the marketing page.
Subprocessors
Three external providers; the last row is our own infrastructure and therefore not a subprocessor. The authoritative, continuously maintained list is the one in the DPA and the privacy policy.
| Provider | Purpose | Registered seat | Data category |
|---|---|---|---|
| mailbox.org (Heinlein Hosting GmbH) | Email delivery (notifications, system mail) | Berlin, Germany | Email address, notification content |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payment processing | Luxembourg | Payment and invoice data |
| Cloudflare, Inc. | Authoritative DNS (name resolution) | USA | DNS queries (IP addresses of the querying resolvers) |
| Hosting: own servers in Germany | Running the application | Germany | All application data (no external hosting provider) |
This list is kept current in the DPA and the privacy policy — if a subprocessor changes, it changes there first.
What Cloudflare does NOT do here: Cloudflare answers exactly one question — which IP address sits behind zuuna.de. The traffic itself runs directly between your browser and our server in Germany. Cloudflare terminates no TLS and sees no request bodies, no credentials and no card contents. You can verify that from outside: a dig zuuna.de returns our own IP, not a Cloudflare address.
Services you connect yourself are not on this list. If you connect GitHub, GitLab, a Slack webhook or your own identity provider, Zuuna talks to those systems on your instruction and by your choice. They are your processors, not ours — which is why they are not in this table.
Access protection
- Enforced two-factor authentication (TOTP plus recovery codes) — enforceable workspace-wide, on every plan, including the free one. Anyone without 2FA is walked through setup on their very next click. At most vendors, exactly this is an enterprise feature.
- Roles and permissions — fine-grained per workspace, on every plan.
- SSO via SAML 2.0 or OpenID Connect, including “Require SSO”: password login switched off, with per-person exemptions so nobody locks themselves out — from Business Pro.
- SCIM provisioning — your identity provider adds members automatically and removes them again — from Business Pro.
- IP allowlist — your workspace reachable only from networks you trust (office, VPN; IPv4 and IPv6) — from Business Pro.
Enforcement is server-side, not hidden in the browser: the 2FA mandate and the IP rules apply to pages and API calls alike — a valid session cannot script its way around them. Which feature sits in which plan is on the pricing page.
Auditability
Every workspace has a security audit log: who changed what, when, and from which IP address. It records security-relevant workspace actions — role changes, removed members, policy changes, SSO configuration, and every time an admin signs in as another member.
And honestly, because this is exactly where trust pages usually fudge: the log shows the last 100 events. It covers workspace actions only — support-side actions are not recorded. There is no export. If your compliance requires a tamper-proof, exportable audit trail spanning years, Zuuna is not that tool today — we would rather tell you here than have you find out in an audit.
What we do NOT claim
Zuuna holds no ISO 27001 certification. Zuuna holds no SOC 2 attestation. Zuuna carries no seal and no badge.
It says so here because nobody else writes that down. Large vendors’ trust centres are walls of certificates — what is missing gets omitted, never named. We turn that around: this page says concretely what exists, and just as concretely what does not. Certifications are audits we, as a small team, simply have not been through yet — that is the whole reason.
If your procurement policy strictly requires an ISO 27001 certificate from the vendor, Zuuna is not the right choice today. We would rather tell you now than after the rollout.
Data export and deletion
No lock-in: you can export any board at any time as Excel (.xlsx) or CSV — in a format that can be imported back. Separate from that is access to your personal data: profile, comments, tracked time and activity download as one machine-readable JSON file — covering Art. 15 (access) and Art. 20 (portability) without a support ticket. It is included on every plan: a statutory right does not belong behind a pricing tier.
You delete your account yourself, without a support ticket: self-service deletion with a 30-day grace period. Within that window you can revoke the deletion; after it, your data is removed.
Next steps
- GDPR-compliant project management — the full overview of the topic.
- The DPA in full — read it before you sign up.
- Pricing — which security feature sits in which plan.
Who is behind this
Trust also depends on who builds a tool and where it comes from: about Zuuna.
FAQ
Where is my data stored?
On our own servers in Germany. There is no external hosting provider and no US cloud behind it — operations are entirely in Germany.
Do I get a DPA?
Yes. The data processing agreement under Art. 28 GDPR is public at zuuna.de/en/dpa — you can read it before you sign up, with no form and no sales call.
Is Zuuna ISO 27001 certified?
No. Zuuna holds no ISO 27001 certification and no SOC 2 attestation. Instead, the security page documents concretely which controls exist and where their limits are — readable rather than sealed.
Can I export my data at any time?
Yes. Any board exports to Excel (.xlsx) or CSV in a re-importable format. You delete your account yourself — with a 30-day grace period during which you can revoke the deletion.
Does Zuuna support SSO and SCIM, and from which plan?
Yes. SSO via SAML 2.0 or OpenID Connect, plus SCIM provisioning and an IP allowlist — from the Business Pro plan; the Developer plan includes all of it too.