Hosted in Germany
Our applications and their databases are hosted on a server we manage at Hetzner in Germany. Automated jobs run at a subprocessor, listed below.
Security and data
Where your data lives, who can access it, and what the AI sees
The answers IT departments, data protection officers, and hospital buyers need before signing: what’s in place, what isn’t yet, and what we’re working on. No certifications we don’t hold, no promises we can’t keep.
Write to the team
A reply within 1 business day.
Four answers up front
Encrypted connections and credentials
Every connection runs over HTTPS. The credentials you give us for your tools, such as your mailbox or your CRM, are encrypted in our database.
Separated by customer
Each customer works in its own workspace, and the application filters every request by organization. Some AgifyMD team members can access it to run the service.
Your lists stay yours
Your lists and your edits stay yours. Export them whenever you want, as CSV or JSON.
What’s in place, and what isn’t yet
One row for each question buyers, IT teams, and data protection officers ask us.
| Topic | Status | Details |
|---|---|---|
| Hosting in the European Union | In place | A server we manage ourselves at Hetzner, in Germany. |
| Encrypted connections | In place | HTTPS required. TLS 1.3 verified on October 10, 2026. |
| Encrypted tool credentials | In place | Gmail and Outlook tokens, mailbox passwords, and CRM keys are encrypted in our database (AES-256-GCM). |
| Databases closed to the internet | In place | Since January 29, 2026, the server firewall only allows web traffic and remote administration. |
| Separation between customers | In place | The application filters every request by organization. |
| Database backups | Planned | A database backup was used for a restore in August 2026. We’re documenting backup frequency, storage location, and encryption. |
| Unsubscribe for the people you contact | In place | Emails sent through Gmail or SMTP carry a one-click unsubscribe option that the recipient’s email app displays. Not yet available for Outlook sends. |
| Data export | In place | Export your lists as CSV or JSON at any time. |
| Data processing agreement (DPA) | Planned | We don’t have one today. We’re preparing a template reviewed by a lawyer, and we won’t promise one until it’s ready. |
| Record of processing activities | Planned | To be written alongside the DPA template. |
| Mandatory two-factor authentication | Not yet | It isn’t required on any account. |
| Access log you can review | Not yet | You can’t yet see who accessed your data. |
| Independent penetration test | Not yet | No external security audit has been carried out so far. |
| ISO 27001, SOC 2, and HDS certifications | Not yet | We hold none of them, and we don’t claim to. |
| AI models hosted in Europe | Not yet | Our products call US-based models. For a custom project, open models hosted in France can be considered. |
Last updated October 10, 2026, based on our product code and server configuration. We update this table whenever something changes.
What the AI sees, and where it runs
What it reads
What the task needs: an account or contact record (name, role, company, public pages), your targeting criteria, your product documents, and the messages to prepare.
Where it runs
Models are called through OpenRouter or directly from OpenAI. These are US companies, so processing may take place outside the European Union.
What we limit
We don’t train any model on your data. For part of our processing, we exclude providers that keep or reuse data. Detailed logs from our prospecting agents are stored on our server in Germany and deleted after 7 days. Trigger.dev, the service that runs our automated jobs, also keeps its own run logs.
Professional data, not patient data
What we process
Healthcare facilities, departments, and professionals: names, roles, and business contact details. Much of it comes from public sources such as the French national healthcare directory (Annuaire Santé).
What we don’t process
No patient data. Our products aren’t designed to receive it, so please don’t send us any.
HDS certification
French law requires it for anyone hosting patient health data. We don’t have it. If a project ever involved such data, we’d tell you before starting, along with the certified hosting it requires.
The people you reach have rights too
Prospecting healthcare professionals is still governed by the GDPR: they must be able to learn where their data came from and opt out easily.
Where their data comes from
The Annuaire Santé directory and public facility pages, public professional profiles read through third-party services, and business contact details found by a specialized provider. Every piece of information keeps its source.
One-click unsubscribe
Emails sent through Gmail or SMTP carry a one-click unsubscribe option that the recipient’s email app displays. Anyone who uses it is removed from future sends, with nothing for you to do.
Exclude a person or an account
You can exclude a person or an entire company, and your campaigns will stop reaching them.
The services that process data on our behalf
Our products don’t work without them. Here’s who does what, and with which data.
| Service | Role | Data involved | Headquarters |
|---|---|---|---|
| Hetzner | Server hosting our applications and their databases | All data in our applications | Germany |
| Clerk | User sign-in and accounts | Your users’ names, email addresses, and sessions | United States |
| OpenRouter | Access to AI models from several providers | Records to analyze and messages to draft | United States |
| OpenAI | AI models called directly, with no intermediary | Records to analyze and messages to draft | United States |
| Trigger.dev | Running automated jobs: research, qualification, and sending | Accounts and contacts being processed | United Kingdom |
| FullEnrich | Finding business contact details | The person’s name, company, and professional profile | United States |
| Unipile | Connecting your reps’ LinkedIn accounts and mailboxes | Invitations, messages, and contact profiles | France |
| Apify | Reading public LinkedIn profiles and posts | Public profiles and posts | Czech Republic |
| Firecrawl, Tavily, Linkup | Web search and reading web pages | Public web pages and the company names we search for | United States (Firecrawl, Tavily), France (Linkup) |
| Resend | Sending automated emails, such as the competitive intelligence digest | Recipient address and digest content | United States |
| Attio and lemlist | Your teams’ CRM and sending tool, if you connect them | Accounts, contacts, and campaigns shared with these tools | United Kingdom (Attio), France (lemlist) |
| Google, Microsoft | Sending from your reps’ Gmail or Outlook mailbox, if you connect it | Emails sent and replies received | United States |
List compiled from our product code on October 10, 2026. The country shown is where the company is headquartered; data may be processed elsewhere.
FAQ
Questions from your legal and IT teams
Not yet. Today we have neither a DPA template nor a record of processing activities. We’re preparing a template reviewed by a lawyer. If your purchase depends on it, tell us, and we’ll give you a realistic date rather than a promise.
Not with our current products: their servers are in Germany and some services are US-based. For a custom project, an architecture with open models hosted in France can be considered, and we’ll tell you exactly what’s possible before you sign anything.
No. We hold none of these certifications, and no external security audit has been carried out. This page describes what we actually do; it isn’t a substitute for a certification.
Not by us: we don’t train any model on your data. Model providers apply their own terms, and for part of our processing we exclude providers that keep or reuse data.
The team members who run the service and support your rollout. We don’t yet keep an access log that you can review.
You export your lists as CSV or JSON before you go. On written request, we then delete the data in your workspace and confirm it in writing. Copies already in our backups are removed as those backups roll over.
Yes. Send it to us through the contact page, and we’ll answer point by point, as candidly as on this page, including when the answer is “not yet.”
Write to us through the contact page and start your message with “Security.” A member of our team will reply within one business day. Please don’t exploit the vulnerability or access data that isn’t yours.
Have a question this page doesn’t answer?
Send us your IT team’s question, your data protection officer’s question, or your security questionnaire. A member of our team will reply in writing within one business day.