Security and Compliance

Elephouse is built and run by one person, in Germany. This page describes exactly where your data lives, who can access it, and how it is protected, backed up and deleted.

Hosting

• Hetzner: All servers and the database run at Hetzner, exclusively in data centers in Germany. Hetzner is ISO 27001 certified. More information
• Brevo: Sends emails such as confirmations and invitations. Brevo only receives your email address for this.

Elephouse uses no Google services, no ads and no third-party trackers. We measure website reach with a self-hosted Umami instance, without cookies.

Sign-in

• Email and password: You sign in with your email address and password. Passwords are only stored in a non-reversible form.
• Protection against guessing: Sign-in, sign-up and password reset are limited to 10 attempts in 3 minutes.
• Two-factor authentication: Is planned.

Sessions

Sessions are stored in signed, HttpOnly cookies that JavaScript cannot read. In the settings you see every active session with device and browser and can end each one individually.

Encryption

Every connection to Elephouse is encrypted with TLS. Unencrypted connections are redirected to HTTPS automatically.

Access

Only the operator of Elephouse has access to the servers and the database. There are no employees and no external contractors with access to your data.

Backups

A snapshot is taken every hour. Snapshots are kept for three months and are stored in Germany as well.

Deletion

If you delete your account, your data is removed from our systems within 30 days. Backups are deleted within three months, in line with legal retention obligations. Before that, you can export all tasks as todo.txt at any time.

System Integrity

Before every update, automated tests and security checks of the dependencies and the code run.

For more details on the services that receive personal data, please refer to our Privacy Policy.