Security and trust

1. Hosting and data location

The hosted platform runs on servers operated by OVHcloud in Germany. Application data, including accounts, demos, screenshots, recordings, translations, analytics and training records, is stored there. ABIT Technology operates the service from Switzerland.

Integrations you choose to use, such as AI generation or payments, process only the data they need under their own terms. They are listed under Sub-processors.

2. Access control

Each organization decides who can see and change its work. Owners, administrators, editors and viewers have separate rights, and drafts stay private until someone publishes them. Published links can require a password, be limited to listed email addresses or company domains, or expire on a date you choose.

Members sign in with a password, a passkey, an email link, or a Google or Microsoft account. Enterprise plans can require single sign-on through your identity provider (OpenID Connect) and synchronize members from Google Workspace. Sessions can be revoked, and sensitive actions require a verified email address.

3. Encryption and application security

All traffic uses HTTPS with TLS 1.2 or later. Passwords are stored only as salted scrypt hashes. API keys, webhook signing secrets and alert channel addresses are encrypted at rest with AES-256-GCM.

Requests pass through a web application firewall based on the OWASP Core Rule Set, with rate limits on sign-in and public endpoints. A strict content security policy limits which scripts and frames pages may load. Platform administration actions are recorded in an audit log.

4. Backups and availability

The production database and uploaded media are backed up daily, and each backup is kept for 30 days. We aim for 99.5% availability each month, excluding announced maintenance. This is a target, not a contractual service level; Enterprise agreements can include one.

You can export any demo as a portable backup file at any time, and share it as a link, an embed, or a PDF, PowerPoint or video export.

5. Incident response

If we become aware of a personal data breach affecting your organization’s data, we notify its owners without undue delay and at the latest within 72 hours. The notice describes what we know, the likely consequences and the measures taken, and we follow up as the investigation progresses.

6. Sub-processors

These providers process personal data on our behalf. AI, narration, sign-in and payment providers only receive data when you use the corresponding feature.

We announce a new sub-processor on this page at least 30 days before it starts processing personal data.

7. Your data and leaving

Your organization owns its content. Export demo backups, contacts as CSV and training reports at any time. When you delete demos or your organization, active data is removed and remaining copies expire with the 30-day backup rotation.

Enterprise plans can run Demo-Creator in a private or on-site deployment.

8. Documents for your review

These documents apply to the hosted service. For security questionnaires or a countersigned copy of the data processing agreement, contact us.

• Data Processing Agreement
• Privacy Policy
• Terms & Conditions
• Request a questionnaire or signed copy

9. Reporting a vulnerability

Found a security issue? Please send the details and steps to reproduce it, and give us reasonable time to fix it before disclosing it publicly: info@abittechnology.com