Tax documents are among the most sensitive papers you own. This page states precisely where your data lives, who processes it, and the controls you hold — stated plainly, and only where we can back it up.
By design, program ongoing
Germany-only storage, pseudonymous accounts, and self-serve erasure and export are built into the architecture. Our compliance program is ongoing work — we state what is in place, not what we aspire to.
Aligning — not yet certified
We are aligning our information security management system with ISO/IEC 27001:2022. We are not certified, and we will not claim to be until we are.
In rollout
AI processing receives only sanitized text extracted from your documents — never the documents themselves. Full EU residency for AI processing is being rolled out.
Your documents and data are stored — and our own document processing runs — entirely in Germany: application servers in Frankfurt (Vercel, region fra1), database and file storage in Frankfurt (Supabase, AWS eu-central-1), document reading on our own server in Germany (Hetzner), and email through Mailgun's EU infrastructure in a German data center. The one processing step not yet EU-resident is AI text interpretation (sanitized text only) — see the compliance status above.
Letters and photos you upload are read on our own infrastructure — the text is extracted by software we host ourselves. The original image or PDF is never sent to any AI provider or any system outside our servers in Germany.
Right to erasure (Art. 17 GDPR): delete your account and all associated data yourself, in the app — no email, no waiting.
Data export: request a copy of your data at any time (hello@taxlumen.de) — delivered as a time-limited secure download link.
| Name | Purpose | Region |
|---|---|---|
| Vercel | App hosting | Germany (Frankfurt) |
| Supabase | Database & file storage | Germany (Frankfurt) |
| Hetzner | Document reading (OCR) | Germany |
| Mailgun | Germany (EU infrastructure, German data center) | |
| OpenAI | AI text interpretation (sanitized text only) | Global — EU residency in rollout |
Is my data encrypted?
Yes. In transit via TLS; at rest with AES-256 on our database and storage infrastructure in Germany (Supabase, Frankfurt).
Where is my data stored and processed?
In Germany. Application servers, database, storage and document reading all run in Germany. The one exception, currently in rollout: AI text interpretation — see compliance status above.
Do AI models train on my data?
No. AI providers receive only sanitized text — never your documents — and your data is never used to train their models. Our primary AI provider processes with zero data retention; the EU fallback provider's zero-retention approval is in progress.
Can I delete or export my data?
Yes, both. Deletion is self-serve in the app — no email, no waiting. Data export is available on request and delivered as a time-limited secure download link.
A full privacy policy is currently in legal review. hello@taxlumen.de