TOM for clockodo.com

Technical and organizational measures

Clockodo GmbH takes the following technical and organisational measures in order to ensure an appropriate level of protection when processing personal data in connection with the use of the SaaS solution clockodo.com. End customer data are processed and stored in ISO-certified Microsoft data centres in the EU Data Boundary. The technical and organisational measures taken by Microsoft can be found at https://www.microsoft.com/de-de/trust-center.

The effectiveness of the technical protective measures is reviewed at least annually. This also includes an assessment of the appropriateness of the level of protection and, where applicable, an adjustment to the current state of the art, for example a migration to newer encryption methods.

Date of last update: 9 October 2026

PDF download: Technical and organizational measures

1. Confidentiality

Measures suitable for preventing unauthorised persons from gaining access to the data processing facilities and from using 
the data processing systems. 

Building management

• Good lighting of outdoor areas
• Security locks on the building doors
• Secure storage of keys not in use
• Persons without access authorisation may enter sensitive areas only under supervision
• Guests and visitors must report to reception
• Guests and visitors are always accompanied by employees
• External service providers must identify themselves when entering the premises/building
• Maintenance work by external service providers is supervised by internal staff

Personnel

• Employee agreement on the handling of keys/codes etc. (including in the event of loss)
• Established off-boarding process, among other things to inform all relevant departments/employees and to im plement all necessary changes regarding the permissions grantedPaper documents are kept in storage facilities appropriate to the risks
• Employee instruction to comply with the ""clean desk principle""
• Regular employee training on relevant data protection and IT security topics
• All employees sign a confidentiality undertaking
• All employees sign an IT usage agreement
• All employees sign an agreement on private email and internet use
• All relevant employees sign a policy on home/mobile office

IT

• Double opt-in for registration (activation link with limited validity)
• IT devices are secured by individual, state-of-the-art authentication methods
• Employees are instructed to actively lock IT devices when leaving the workstation
• Passwords are stored using a suitable cryptographic method
• Two-factor or multi-factor authentication for high-risk processing
• Automatic account lockout after repeated incorrect password entry
• Factory-set authentication information is changed without undue delay
• Full encryption of computers and laptops and external storage media
• Use of mobile device management (MDM)
• Access permissions based on the ""need-to-know"" principle
• Regular (random-sample) review of the permissions granted
• Role-based access control (RBAC) at user level, including within the AI processing
• Segmentation of networks
• Use of regularly updated antivirus software on all IT devices
• Regular vulnerability scans
• Defined deletion periods and automated deletion processes
• Destruction of storage media in accordance with the state of the art
• Carrying paper documents and data (media) outside the business premises is permitted only where strictly nec essary
• Destruction of files and storage media in accordance with the state of the art
• Separation of production, archive and test environments
• Secure software development and delivery through code review and defined release processes
• Separation of tenant data at database level
• Separation of tenant data in the AI processing: prompts, context, caches and indexes contain only data of the respective tenant
• IT and data protection incidents are handled via a defined process
• Remote wiping of mobile devices in the event of loss
• Unauthorised access to the company network is prevented by a ("NextGen") firewall
• Technical exclusion of sensitive reasons for absence and of special categories from the AI processing
• Pseudonymisation of personal data where possible
• Masking of sensitive customer data for Clockodo service staff
• Encryption of the database by Microsoft

2. Integrity

Measures that ensure that personal data cannot be read, copied, altered or removed without authorisation during elec
tronic transmission.

• Transport encryption (TLS) for all public connections over which personal data are transmitted - website via HTTPS protocol
• Remote access from insecure networks to the internal company network is generally carried out via a secure VPN connection • Implementation of the HSTS standard
• Where technically possible, individual input and deletion logs are created
• Encrypted backups separated from the production system with restricted access
• Careful selection of the processors as well as regular monitoring of the sub-processors beyond the selection stage

3. Availability and Resilience

Measures that ensure that personal data are protected against accidental destruction or loss. 

• Automatic security updates of the operating system and software applications
• A backup concept appropriate to the risk and the state of the art exists, which is evaluated regularly and adapted 
  as needed
• An emergency plan appropriate to the risk exists