Built secure, ready for GDPR
Servers and database in Düsseldorf, TLS 1.3 in transit, an encrypted database with an encrypted backup every hour. The Data Processing Agreement, data export and erasure come with every plan.
Security and Compliance
On every plan
- GDPR export and erasure built in
- Servers in Düsseldorf, Germany
- TLS 1.3 in transit, database encrypted at rest
- Encrypted database backups every hour
- Public DPA with sub-processor list
- Two-factor authentication
GDPR basics, built into the platform
The Data Processing Agreement is public, lists its sub-processors with their locations and applies from the first day you use the platform. Members confirm your terms and privacy policy when they register, and cookie choices are logged.
- Data Processing Agreement (AVV) included
- Sub-processors listed with location and transfer basis
- Terms and privacy consent recorded at registration
- Cookie banner with a consent log
- Data centre ISO/IEC 27001 (WIIT AG)
Data Processing Agreement
Public, applies from the first day on the platform
Sub-processors
Location
- Germany
Servers, database, backups
WIIT AG
- EU
Files, videos, delivery
BunnyWay
- Ireland
Payments
Stripe
- USA, SCCs
Email delivery
Resend
- EU, UK
Realtime updates
Pusher / Ably
- USA, SCCs
AI features
Anthropic
Data centre ISO/IEC 27001 (WIIT AG)
Certificate of the data centre operator, not of the platform
Consent records
Terms and privacy policy
Accepted at registration with version, time and IP
Cookie banner
Choices logged, exportable as CSV
Exactly the right people see exactly the right thing
Roles and permissions govern your team. Access rules govern your members: open a course, a hub or a community area to single members, to a group or to everyone who bought a linked product.
- Role-based permissions for your team
- Access per course, hub and community area
- Access through members, groups and linked products
- Grant or revoke course and group access with automations
Advanced Module
Access through the VIP group or a linked product
Hosted in Germany, encrypted and checked every minute
Servers and database run at WIIT AG in Düsseldorf. Connections use TLS 1.3, the database is encrypted at rest and an encrypted database backup leaves the server every hour. A public status page shows the result of checks that run every minute.
- Servers and database in Düsseldorf, Germany
- TLS 1.3 in transit, encrypted database at rest
- Encrypted database backups every hour, kept off-site
- Status checks every minute on a public status page
Servers
Düsseldorf
Database backups
Every hour
In transit
TLS 1.3
Database at rest
Encrypted
Answer data requests without a developer
Members download their own data from their profile and can ask for deletion. You export a member's data as a ZIP file or erase and anonymize the account, while invoices stay on record.
- Members export their own data
- Export a member's data as a ZIP file
- Erase and anonymize, invoices stay on record
- Deletion requests in one queue, with status and handler
Marco Lindt
Data subject request
Preparing export...
Erase and anonymize
Honors the right to be forgotten
Hardened sign-in your members can trust
Two-factor authentication by app or email code, an alert when a new device signs in, login throttling and single sign-on for your existing login. Members see which devices are signed in to their account and can sign them out.
- Two-factor authentication by app or email code
- Two-factor required for platform administrators, and for your owners and admins once you switch it on
- Email alert when a new device signs in
- Single sign-on for your existing login
- Login throttling and a check against breached passwords
Two-factor authentication
Enter the 6-digit code
Mac
Apple Safari
iOS Device
Apple Safari
Logout DeviceWhy it matters
Trust is the foundation of every membership
Members hand you their data and their payment details. Protecting both is non-negotiable, and stitching it together yourself is where the risk hides.
The usual setup
- Member data scattered across spreadsheets and overseas tools
- No Data Processing Agreement, so you carry the legal risk
- Everyone on the team can see everything
- No clean way to honor an export or deletion request
With MemberArea
- One platform, with servers and database in Düsseldorf
- A public DPA with its sub-processors and their locations
- Roles, permissions and per-content access gating
- Data export and erasure for any member, built into the admin
The payoff
Security you can point to
Compliance should be something you can show a client, a DPO or a member in seconds, not a project you keep postponing.
of app servers and the database run in Düsseldorf, Germany
for two-factor secrets and integration keys, with TLS 1.3 in transit
encrypted database backups a day, stored off-site
Servers and database run at WIIT AG in Düsseldorf. Payments, email, file delivery, realtime updates and AI features use the sub-processors listed in the DPA, some outside the EU under standard contractual clauses. Your obligations as a data controller still apply.
Everything in security
Security that runs underneath everything
Security should not be a project on your list. It is part of how the platform works, set up from one admin and on every plan.
Built for GDPR
A Data Processing Agreement, consent records and tools to export or erase member data.
Encryption in transit and at rest
TLS 1.3 in transit, an encrypted database and encrypted database backups, AES-256 for two-factor secrets and integration keys.
Hosting in Germany
Servers and database run at WIIT AG in Düsseldorf. Files are stored with Bunny in Germany and delivered through its CDN.
Access control
Roles, permissions and per-content gating decide exactly who sees what.
Secure authentication
Two-factor authentication, login throttling, breached-password checks and single sign-on.
Data rights and deletion
Export or erase a member's data on request. Invoices stay on record as the law requires.
Data Processing Agreement
A public DPA with its version date, sub-processors and their locations.
Automated backups
An encrypted database backup every hour and a nightly copy of images, files and audio in a separate backup storage.
Uptime and status
Automated checks every minute feed a public status page with 90 days of history.
The documents behind it
Read the fine print, in plain sight
Compliance is only real if you can read it. Every legal document is public, dated and one click away.
Data Processing Agreement
The AVV that governs how member data is processed, including the sub-processors and their locations.
Privacy Policy
What data is collected, why it is held and how long it is kept.
Terms of Service
The agreement that governs how the platform may be used.
Report a vulnerability
How to report a security issue responsibly, what is off limits and when you hear back from us.
Accessibility statement
How accessible checkout, sign-in, member area, courses and booking pages are, the known barriers and where to report one.
Run a platform you can stand behind
Launch on servers in Germany with encryption, backups and GDPR tools built in. Start with a 14-day free trial.
No credit card required. Cancel anytime.