Security and privacy at nest54 – GDPR, hosted in Germany

Your data stays in Germany and under your control: encrypted per organization, with a unified permission model and traceable logging.

Start for free Request a demo

Security & privacy

nest54 is operated as a cloud service on servers in Germany. Office, video meetings, and speech recognition all run on these servers—not with US tech giants.

Hosted in Germany

Operated in a German data center, with nightly backups and regular restore tests.

Encryption

Files are stored encrypted with a dedicated key per organization—and so are credentials for mailboxes and apps.

One permission model

Permissions apply consistently from the workspace down to the file. Admin rights don't grant access to content.

Strong authentication

Two-factor authentication, passkeys, single sign-on via OIDC and SAML, and alerts for new devices.

Fully traceable

Hash-chained audit log with integrity verification, tamper-proof (retention-locked) folders, and legal hold.

AI only if you want it

Each organization decides whether to enable optional AI insights for transcripts; without approval, no content leaves the platform.

Security and privacy

A single, unified permission model applies everywhere—from the workspace to the folder to the individual file. Administrators manage, but can't see content.

• Two-factor authentication with an app or passkey, optionally mandatory.
• Files encrypted with a dedicated key per organization.
• Session management, alerts for sign-ins from new devices, and protection against leaked passwords.
• Tamper-evident audit log, tamper-proof (retention-locked) folders, and legal hold.

Single sign-on and automatic provisioning

from the Business plan

Companies sign in with their existing corporate accounts. New employees get access automatically—and anyone who leaves the company loses it immediately.

• Single sign-on via OpenID Connect or SAML 2.0—e.g., with Microsoft Entra ID, Okta, Google, or Keycloak.

• SCIM 2.0: accounts and groups are created, updated, and deactivated by your identity provider.

• Offboarding with handover of files, calendars, and tasks to a successor.

     GDPR

nest54 processes your organization’s content on your behalf. You conclude the legal agreements directly in the platform.

Data processing agreement online

Administrators conclude the data processing agreement under Art. 28 GDPR directly in nest54 when getting started – no paperwork.

Processing in Germany

Servers in German data centers (Hetzner). Office, video meetings and speech recognition run on these servers.

Few service providers

Core operations rely only on the data center. Microsoft, AI services or apps are used only if you activate them yourself.

Your data, exportable at any time

Files, calendars and contacts can be downloaded at any time via standard interfaces such as WebDAV, CalDAV and CardDAV.

Clear deletion rules

Trash, deletion periods for transcripts and deletion after the contract ends – with retention periods and legal hold where required.

Transparent and traceable

A hash-chained audit log shows who changed what and when; administrators manage, but cannot see any content.

Data processing agreement (DPA) Platform privacy notice Terms of use

   FAQ

In a personal demo, we'll show you how your team and your partners can work together in nest54—and we'll be happy to set up a trial workspace for you.

Request a demo