Security
Security and data protection: what we do and how you can check it
This page is for CISOs, data protection officers and procurement. It sets out who at Senva sees which data and which documents you receive.
Data access
Who sees which data
This matrix applies to the data in every client project. Access beyond what is shown here is only possible for the Berlin team, and only if the contract says so. How this website itself processes data, for example with Google Analytics after your consent, is described in the privacy policy.
| Type of data | Berlin team | Hanoi partner team | Where it is stored |
|---|---|---|---|
| Production data | Only when the project requires it, within the agreed scope | No access | Your systems or the EU region of the project's hosting |
| Personal data | Only within the data processing agreement (AVV) | No access | EU, with the region set per project in the contract |
| Test and synthetic data | Yes | Yes, synthetic or anonymised only | Development and test environment, set per project |
| Source code | Yes | Yes | Your repository or Senva's |
Under the GDPR, pseudonymised data counts as personal data, and we handle it accordingly. It falls under the “Personal data” row.
Two-zone model
Your code may travel.
Your data stays.
Zone 1
Berlin
- Architecture, security review, core development and project management.
- If a project needs access to production systems or personal data, that access sits here, within the scope agreed in the contract.
Zone 2
Hanoi (partner team)
- A partner company that works for Senva as a subcontractor. Its staff are not employed by Senva GmbH.
- The partner team works only with synthetic or anonymised test data.
- No access to production systems and no access to personal data of any kind.
Hosting
Per project, in an EU region
We decide per project where your system runs: in an EU region of a cloud provider such as AWS or Azure, with a European provider, or on your own infrastructure. The region is written into the contract.
Whether you choose a US provider's EU region or a European provider is your decision. We explain the differences, including the question of which authorities outside the EU could demand that data be handed over.
Contracts and documents
What you receive on request
- Data processing agreement (AVV) under Art. 28 GDPR
- Technical and organisational measures (TOMs)
- List of subcontractors
- Non-disclosure agreement (NDA), before the intro call if you wish
- Answers to your supplier or security questionnaire
Send requests to info@senva.de.
EU AI Act
How we handle the EU AI Act
- At the start of every AI project we establish your role (provider or deployer) and the system's risk category, and we write down the reasoning.
- We document purpose, data provenance, tests and known limitations in a form you can use for your own obligations.
- We do not build anything that falls under the practices prohibited by Art. 5 since 2 February 2025. This includes the additional prohibitions that Regulation (EU) 2026/1744 adds from 2 December 2026.
- The transparency obligations under Art. 50 have applied since 2 August 2026. Under Regulation (EU) 2026/1744 (the Digital Omnibus), the obligations for high-risk systems apply from 2 December 2027, and from 2 August 2028 for AI in products under Annex I.
- The illustrations and videos on this website are AI-generated. The footer of every page says so.
We certify nothing and do not replace legal advice. We provide the technical basis on which your legal team makes its decision.
NIS2
Your supply chain, our answers
If your company falls under NIS2, your risk management also has to cover the security of your supply chain. Art. 21 of the directive requires this, and in Germany so does Section 30 of the BSI Act (BSIG) as amended by the NIS2 Implementation Act, in force since 6 December 2025. We answer your supplier questionnaire in writing, question by question. Where there is evidence, we attach it. Where the honest answer is “no”, the answer says “no”.
Cyber Resilience Act
Support for your products
If you place products with digital elements on the EU market as a manufacturer, you have had to report actively exploited vulnerabilities and severe security incidents since 11 September 2026. The remaining manufacturer obligations apply from 11 December 2027. We help with the software bill of materials (SBOM), the process for handling and reporting vulnerabilities, and the technical documentation. The conformity assessment stays with you.
Responsible disclosure
Reporting a vulnerability
If you find a vulnerability on this website or in software we look after, write to security@senva.de. The details are also in our security.txt.
It helps if you include the affected address or component, steps to reproduce, your assessment of the impact and how we can reach you.
Please do not access third-party data or disrupt operations while doing so. Systems belonging to our clients may only be tested with their permission; we cannot grant that permission on their behalf.
We acknowledge receipt and keep you updated on the fix. If the vulnerability affects a client's software, we inform the client and agree the next steps with them.
We do not run a bug bounty programme.
Accessibility
Target: WCAG 2.2, level AA
This website aims to meet WCAG 2.2 at level AA. We test with keyboard and screen reader. If you run into a barrier, write to info@senva.de and tell us which page.
For portals we build, we set the accessibility target per project, for example WCAG 2.2 AA. If you offer certain digital services to consumers, for example in e-commerce, banking or telecommunications, the European Accessibility Act has applied to them since 28 June 2025, with an exemption for microenterprises providing services. In Germany it is implemented by the Accessibility Strengthening Act (Barrierefreiheitsstärkungsgesetz, BFSG).
Intro call
Questions from your vendor assessment
Send your questionnaire or your questions to info@senva.de. If you'd rather talk, Kim Pham will take 30 minutes for a call, and we sign an NDA beforehand if you wish.
- info@senva.de
- Phone
- +49 30 5268 7541
- Address
- Bundesallee 32, 10717 Berlin, Germany