Trust is a feature here.

Where your data is stored

The cloud services of the irot family run on servers operated by Hetzner Online GmbH in its Falkenstein data center, Germany. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

No customer sees another customer's data. How the data is kept apart depends on the program, and we say exactly how: irot Time runs a dedicated instance for each customer. irot Kalibrat keeps each customer's inspection and equipment data in a separate database of its own; login, contract and billing data are kept in a central administration database of the provider. irot Erstmuster and irot 8D share one database in which every row belongs to one business; the database itself (row-level security) shows the application only the rows of the business that is signed in, and drawings and reports are stored encrypted with a key of their own for each business.

If you prefer not to use the cloud at all, you can run irot Kalibrat and irot Time on your own premises under Windows, Linux or Docker – with the same features.

Technical and organizational measures

• All data is transmitted only in encrypted form (TLS), with HSTS.
• Server login only with cryptographic keys; password login is disabled.
• Separate data storage for each customer.
• Passwords and PINs are stored only as hashes from a deliberately slow method (scrypt; bcrypt in irot Time), never in plain text.
• Lockout after repeated failed login attempts.
• Daily backups, encrypted; the key to decrypt them is not on the server. Deleted after 14 days (irot Erstmuster, irot 8D) or at the latest after 31 days (irot Kalibrat, irot Time).
• The application runs without system privileges in a restricted environment.
• Changes to records are logged; the log is only ever added to, never rewritten. In irot Kalibrat, entries are voided rather than deleted.

The measures for irot Kalibrat are documented in detail in the privacy policy of kalibrat.irot.com (section 8).

Who else processes your data

For irot Kalibrat – each under an agreement pursuant to Art. 28 GDPR, and only if the respective feature is used:

Image recognition stays switched off until you subscribe to it. Only then is a scanned calibration certificate – never the equipment register, never the inspection history – transferred to an AI service outside the EU (Alibaba Cloud, Singapore, or alternatively Anthropic, USA), on the basis of standard contractual clauses. Without this subscription, the application is fully usable.

For irot Time, the privacy policy on time.irot.com applies. The irot Time AI assistant stays off until an administrator gives consent, and by default works with personnel numbers instead of names – it never processes health data.

Your data belongs to you

• Export anytime – irot Kalibrat to Excel and as a complete audit package.
• Nothing you already have gets locked: After the trial or a cancellation, your records remain readable, printable and exportable; with irot Time, clocking in and out and reports remain available without a license.
• After the contract ends, we hand over the data on request and then delete it – taking into account your statutory retention obligations.
• No use for our own purposes: We do not analyze your data, train our own models on it or sell it.

This website

irot.com sets no cookies, uses no analytics, tracking or advertising services, loads no content from third-party servers and stores no access logs. A strict Content Security Policy ensures that the browser enforces this too. Details can be found in the privacy policy.

Found a vulnerability?

Write to info@irot.com – we usually respond within one business day and fix confirmed vulnerabilities as a priority. Machine-readable contact details are available at /.well-known/security.txt.

Certifications – in all honesty

There is currently no ISO 27001 certification. Instead of a seal, we disclose what we do: the measures above are documented and verifiable, and your organization's information security team can receive information on every point upon request.