Funding and Digitalbonus
Which German programmes still subsidise digitalisation in a construction firm, what expired in 2024, and where to check …
Learn moreComing soon
Levora
What happens to your data – and what does not
This page also names what is still missing. A security page on which everything is already in place either has nothing to say or is not telling the truth.
The Zettel is the most sensitive part
A measurement sheet from hazard-site work carries an address, a date, often a name, and always a service performed for a public authority. That is not an internal company note but a document touching third parties – and the reason the Zettel recognition has its own rules here.
Where
Where the data sits
Data centre in Germany
Operated at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. The servers are in Germany; there is no transfer to a third country. The specific data centre location is named in the data processing agreement – that is where it is binding, not on a website that can change.
One processor, not three
There is no chain of analytics, mail and storage services in different countries. The hoster is the only third party that gets to see data – and even it only as a processor under Art. 28 GDPR.
In place today
What is in the product today
Every point here is implemented in code and verifiable – not planned, not in progress.
Tenant separation at the data layer
Every access to a record is restricted to the tenant. There is no way to reach another firm’s data through an ID.
Roles and permissions
Personnel data and contracts are visible to administrators only; so are write operations. A colleague capturing Zettel does not see a personnel file.
Access log
Access to staff and contract data, and every invoice cancellation, is logged: who, when, which record. That is the evidence required by Art. 30 and 32 GDPR.
Encrypted documents
ID cards, driving licence scans and contracts are stored AES-256-GCM encrypted in object storage – never in clear text. The driving licence number is encrypted in the database as well.
Invoices stay what they were
An issued invoice is neither overwritten nor deleted. A cancellation sets the original to “cancelled” and creates a credit note – both remain in place.
GoBD export for the tax audit
The auditor gets the Z3 package: a ZIP with invoice headers, invoice lines and an index.xml following the description standard. Not assembled on request, but a button.
Site diary as evidence
A closed diary entry is immutable – the precondition for it to be worth anything under VOB/B in a dispute.
Encrypted transport
Mutual TLS authentication between gateway and data service is set up and active – a service without its own certificate does not get through; the reflection interface is switched off in operation.
The Zettel recognition and the AI
Two points on which we have committed ourselves – and which no competitor discloses this way:
Every request to a language model is nailed to zero data retention. When a Zettel goes to a model for text recognition, Levora sets data_collection: "deny" and zdr: true on every single request. That means the request may only run through providers that store nothing and use nothing for training. This is not a setting someone can forget – it sits as a constant in the client, not in a configuration file, and tests on both paths (Go and Python) fail if anyone takes it out.
Without a key, nothing happens at all. If no model access is configured, the classical image recognition simply continues on its own. There is no silent fallback to a foreign service.
The AI assistant is read-only. Every tool it can use answers a question; none of them writes. A model that can issue an invoice is a model that can issue the wrong one – and Levora’s write operations are financially effective and audited. Write capability comes later, and as a proposal that a human applies, not as an execution.
Plus a small detail with a large effect: no tool takes a tenant as an argument. The tenant comes from the caller’s context. So there is no field into which a model could accidentally write another firm’s identifier. A test prevents anyone from adding such an argument later.
Your data is yours – technically too
The full data export is a function, not a favour: master data, bills of quantities, measurements and invoices as CSV and GAEB, at any time during the term. It is restricted to administrators and is logged – a complete dump of a firm’s data is itself a sensitive operation.
Why this is here: “What happens to my data if I switch?” is one of the first questions a German construction firm asks, and the usual answers are vague. This one is not.
Not yet
What is missing – and when it should arrive
Without asterisks and without “coming soon”.
ISO 27001
Not in place. Planned in the medium term. Anyone who needs a certificate as a condition of award will not get it from us today.
BSI C5 attestation
Not in place. Planned in the medium term, relevant above all for public and larger commercial clients.
Encryption at rest
The particularly sensitive fields are encrypted at application level. For the remaining columns – name, address, contract data, which have to be filtered and sorted – encryption is at operational level (encrypted volumes, encrypted backups). That is an operational commitment, not a code promise, and belongs in the data processing agreement as such.
Data processing agreement
Provided before the contract is concluded. A ready-made template for download is not here yet – when it comes, it will have been reviewed by a lawyer, not assembled by us.
Third-party penetration test
Not carried out. It becomes worthwhile as soon as the first customer works in production.
Frequently asked
Questions from firms working in Germany
Does our data leave Germany?
No. The servers are in Germany and there is no third-country transfer. The nationality of your firm’s owners does not change that – what matters is where the data is processed, not who operates the business.
Our client asks for data protection evidence. What can you supply?
The data processing agreement and the points on this page. What we cannot supply is ISO 27001 or BSI C5 – neither exists, and it says so above. If your client makes one of them a condition, say so before the contract, not after.
Is the interface in English?
No, the interface is German, and deliberately so: the tender, the form fields and the authority’s letter are German, and a translated field label would only make it harder to find the same word in the paperwork. These explanatory pages stay in English.
We are an EU company operating in Germany. Does GDPR change anything for us?
Not in what Levora does – the same rules apply throughout the EU. The one thing worth checking is your own contract with your client, which may name additional requirements. Tell us which; we will say what we can evidence today.
Go through these points in the conversation
If your client demands evidence, tell us which. We will tell you what we can prove today and what we cannot – before the contract, not after.