Security that belongs in every process
OXS.eco is operated on Google Cloud, with the security and compliance standards of the cloud provider (edge protection, OWASP Top 10 rules at the Google edge, EU hosting). These provider services are distinct from what OXS.eco and MAAS deliver as a product, and from the project-specific operating model.
What we support in concrete terms: requests are filtered at the Google edge, data can be encrypted in transit and at rest, access can be controlled granularly, and relevant actions can be logged and made exportable for audit purposes. What applies in your case depends on the setup, the operating model and your contract.
When the auditor calls, you can find the right documents and case files
External audit, internal audit, BaFin, Betriebsprüfung, KRITIS (critical infrastructure) audit or a data protection authority. Depending on the setup and the operating model, matches, case files and the complete record of who changed what and when (audit trail) can be produced from a filtered query.
Four steps from the request to a documented answer
The auditor asks: "All contracts with supplier XY between 2020 and 2024." The full-text search targets the yearly layers. 47 matches are listed and exported, and every step lands in the audit trail with a timestamp, the user and a hash.
External audit, internal audit and data protection requests all use the same search logic.
Audited at the platform level
What we are responsible for ourselves is governed by the data processing agreement you sign directly with MAAS. For the infrastructure underneath we build on Google Cloud, audited against the standards that external auditors, BaFin and data protection authorities ask for. These certificates cover the platform OXS.eco runs on.
Google Cloud's current certificates and audit reports are published at cloud.google.com/security/compliance for anyone to review.
Encryption, hosting and access
OXS.eco runs on Google Cloud in Frankfurt. All data is encrypted in transit and at rest, without you having to take care of it.
Data location
Operated on Google Cloud in Frankfurt. Processing and storage in the EU.
Encryption
Transmission and stored documents are encrypted. The procedures and the key management sit with the Google Cloud platform and are documented there.
High availability
Redundant storage and backups on the Google Cloud platform. What applies to recovery for your operation is set out in your contract.
DDoS protection
Google Cloud Armor shields the application and the API against volumetric and layer 7 attacks.
Aligned with GoBD, GDPR and audit-proof archiving
We support the implementation of regulatory requirements technically and organizationally. What applies depends on the setup, the operating model and your contract. The data processing agreement and the TOMs can be provided in the project, and sub-processors and the operating model are reviewed per project.
Aligned with GoBD
Immutability, completeness, traceability and machine-readable evaluation can be aligned with GoBD principles, depending on the setup and the operating model.
GDPR-compliant
Data processing agreement available / TOMs documented. The record of processing activities and the deletion and subject access processes are set up per project.
Retention periods
Retention control can be configured. Documents stay as long as intended and can be deleted with a traceable record.
Audit reports
Relevant reports can be produced for internal audit, external auditors and authorities, depending on the setup and the operating model.
We provide the data processing agreement, the TOMs and the full sub-processor list on request. Direct line: datenschutz@maas.de
Who may see, change and approve what
Granular permissions, cleanly separated tenants and a complete audit trail, so responsibilities stay clear.
Roles & permissions
Fine-grained control at case file, document and field level, down to individual workflow steps such as the second approval. Roles can be inherited and combined. Supports the four-eyes principle and deputy arrangements.
Multi-tenancy
Clean separation between business units, subsidiaries or customer groups.
Audit trail
Every action (read, change, approve, delete) is logged with the user, a timestamp and the context.
SSO & MFA
Single sign-on via SAML/OIDC and multi-factor authentication for sensitive areas.
Hélène TinetInitial call, demo & onboarding
Talk security in 15 minutes.
We show you how permissions, the audit trail and retention periods work together in OXS.eco, using your own process as the example. You talk to a person from the MAAS team.
More on trust