Privacy and security
Privacy and security: we are the gate, not your new system.
Cable Creations accepts inquiries and passes them on to the system you already use. Your sales team does not move. This page says where the data lives, who sees it, and what leaves the platform.
- Servers in Germany
- Data kept apart per organization
- Only owners set up connections
- Access keys stored encrypted
The principle
The gate, not your new system
You do not have to move to new software for inquiries. That lowers the barrier to using Cable Creations.
Your system stays your system
Inquiries from your catalog and replies to your showcases arrive in your CRM, table, inbox, or chat. Your sales team keeps working there.
The portal delivers and keeps little
The portal blanks out the content of a delivery in its queue after 30 days. Only the ID and the source remain.
You decide where
Only an owner of your organization sets up a connection, checks it with a test, and can pause it.
Location
Where the data lives and who processes it
Our data lives in Germany. Two service providers are under a contract under Art. 28 GDPR.
| Provider | For what | Where |
|---|---|---|
| Hetzner Online GmbH | Servers, database, file storage, backups, mail server | Data centers in Germany, certified to ISO/IEC 27001 |
| Amazon Web Services EMEA SARL (Amazon SES) | Sending the platform's emails, such as notifications about inquiries | Frankfurt am Main; EU-US Data Privacy Framework and EU standard contractual clauses |
- We do not run server rooms of our own.
- We process the data in the European Union or the European Economic Area. A transfer to a third country happens only under Art. 44 ff. GDPR.
- For inquiries through your forms, you as the manufacturer are the controller, and we process them on your behalf. The data processing agreement is part of every contract.
Access
Who sees what
Every query is bound to an organization. What someone sees is decided by their role.
| Who | Sees and does |
|---|---|
| Owner | Everything a member may, plus the team, billing, API keys, the audit log, and the connections that pass inquiries on. |
| Admin and member | The organization's cables, images, catalogs, and showcases. Team, billing, keys, audit log, and connections stay with the owners. |
| Guest | Their own account, the cables, the media library, the kits, and their own orders. They order only within a budget. |
| Cable Creations staff | A customer's portal only on its behalf, for a limited time and logged, with a second factor. |
- An organization's data is not visible to other organizations: every query of the platform is bound to an organization.
- File storage is private. Files are reached only through the application with a permission check, or through secret links that expire.
Passing on
What leaves the platform, and how
Data leaves the platform only through a connection that an owner of your organization set up themselves.
What is delivered
Name, email address, company, message, the cable asked about, and the source of the inquiry, plus the time of the inquiry and of the consent.
Where to
Only to the systems an owner connected: CRM, table, inbox, chat, or an address for the webhook. The inbox gets the inquiry as an email through the platform's mail sending.
How
Encrypted with TLS. Webhooks are signed, and the signing key is stored encrypted. Calls go only to publicly reachable addresses, follow no redirect, and read at most one megabyte of answer.
With which access
With the token you create in your system, never with your password. The portal stores the token encrypted and does not show it again.
New inquiries only
Inquiries that arrive after the setup are delivered. Older ones are not delivered afterward.
If something fails
The portal retries the delivery. If it keeps failing for days, it pauses the connection and writes to the owners.
Retention
How long data stays
A selection from our privacy policy, which has the full list.
| Data | How long |
|---|---|
| The content of a delivery to your system, in the portal's queue | 30 days, then blanked out; immediately if the inquiry is deleted |
| Sessions with IP address and browser ID | 30 days after the session expires |
| An organization's files after the contract ends | 90 days after the end of the paid period |
| Cable data after the end of the trial or the contract | 24 months after those 90 days |
| Backups | Database 14 days; deleted files leave the backup after 30 days |
Security
Technical and organizational measures
Annex 2 of our data processing agreement lists them in detail. Here are the most important ones.
Sign-in
Passwords only as a hash, a lockout after repeated failures, a warning on a new device. Sessions are visible and can be ended one by one.
Second factor
Required for all our staff, available for your team.
Keys
API keys exist only as a hash. A webhook's signing key and the connections' tokens are stored encrypted.
Audit log
Significant actions stay in the log unchangeably: who created, changed, approved, or deleted what, and when. Actions our staff take on your behalf are marked.
Separation
Separate environments for development, test, and operation. Test data holds no real personal data.
Backups
The database is backed up daily and kept for 14 days. Restoring is documented.
Measurement without cookies
Audience measurement works without cookies and stores no IP addresses.
Limits
What we do not claim
Security also means naming the limits.
Not every address is stored encrypted
The addresses of Slack, Teams, and Google Chat contain a secret and are readable in the database. The portal shows only the host. The tokens of CRMs and tables are encrypted.
What lies in your system is yours
Once the portal has delivered an inquiry, the location and security of your system apply to it. For Zapier, Make, and n8n, their terms apply.
The certification covers the data center
ISO/IEC 27001 concerns our host's data center. We claim no certificate of our own.
The legal basis stays with you
Connect only a system in which you may process the data. The person's consent is attached to the inquiry with its time.
Questions
Questions about privacy or security?
Write to us. The agreements and the privacy policy are here in full.