Security and trust
Where revenexx hosts data, what it commits to in the contract, what it has not published, and which page answers each question a CTO or security reviewer asks.
This page is for the architect, CTO or security reviewer deciding whether to build on revenexx. It answers each common question in one line and sends you to the page or contract clause behind it. Every row restates something its Source column points to, and where the platform publishes nothing, the row says so.
If a merchant has sent you a security questionnaire, start with Answer a customer's security questionnaire. It maps each questionnaire area to a source and lists the questions to send to revenexx.
Four terms recur. A tenant is a workspace under an organization, with its own isolated data. The gateway is the single entry point for API calls. ID is the platform's sign-in service. An App is installable business logic. The glossary defines them all.
Contract answers come from the terms, which are in German. The clauses below are taken from the questionnaire guide, which was checked against version v12 of the terms, July 2026 (as of 2026-09). Check the version on the page before you cite a clause.
Quote what is published, and no further. The security management system is described as oriented on ISO/IEC 27001, which is not the same as certified. No SOC 2 report and no penetration test is published (as of 2026-09). Confirm with us means the question is for revenexx: send it through support.revenexx.com.
Hosting, isolation and transport
| Question | Answer today | Source |
|---|---|---|
| Where is data stored? | In EU data centres (contract). The docs describe one origin, in Germany, where a tenant's data is stored. There is no region to choose | Terms § 18 (4), Edge network |
| Is traffic processed anywhere else? | Traffic to storefront and asset domains is terminated at four edge locations: Nuremberg, Ashburn, Hillsboro and Singapore. They are a delivery and filtering layer, not the place data is stored, but they hold cached copies of content requested through them, including uploaded files, until the entry expires. The API is not fronted by them | Edge network. Fit with § 18 (4): confirm with us |
| How are tenants isolated? | Every request names its tenant, and the gateway checks the credential against that tenant first. An API key identifies one tenant | Architecture |
| Encryption in transit? | HTTPS only, TLS 1.2 or 1.3. Older versions are refused | TLS |
| Encryption at rest? | Published only for Integration Studio secrets (AES-256-GCM). Platform-wide measures are described in the security annex of the terms | Secrets, Answer a customer's security questionnaire. Platform-wide: confirm with us |
Access and what an App may do
| Question | Answer today | Source |
|---|---|---|
| How do systems authenticate? | Scoped API keys, one tenant each, shown once, revocable. Keys do not expire on their own, so rotation is a process you run | API keys |
| How do people sign in? | Through ID. Multi-factor authentication is a tenant policy set with your platform administrator, not something an App switches on | Multi-factor authentication |
| Is an App's consent screen a boundary? | An App declares permissions in nine classes. Three are enforced: entity, identity and capability. For the other six, treat the consent screen as a statement of intent, not a boundary (as of 2026-09) | Answer a customer's security questionnaire, Permissions |
| Is there an audit log? | Records of changes exist per domain, for example Integration Studio and an order's history. Reads are not audited, and no tenant-wide feed for key use, sign-ins or administrative actions is documented (as of 2026-09) | Answer a customer's security questionnaire, Revisions and audit |
Contract, compliance and AI
| Question | Answer today | Source |
|---|---|---|
| Availability and support terms? | A monthly availability commitment, and support response times by plan and priority, are part of the contract. The figures are in the terms, and these docs do not restate them so the contract stays the single source | Terms § 21 and Annex 4 |
| Sub-processors and data processing? | Governed by the data-processing agreement and the sub-processor list. New sub-processors are announced 30 days ahead | Terms § 12, § 16, Annex 3, Annex 6 |
| Data export and deletion? | The merchant can export data on request for 30 days after the contract ends. Production data may then be deleted within 90 days, and must be where data protection law requires it | Terms § 15. The route for bulk data is Import and export. A full-tenant export procedure: confirm with us |
| Incident notification? | Incidents that significantly affect customer data are reported without undue delay, in text form. No number of hours is published (as of 2026-09) | Terms § 13 |
| Where do AI features run? | AI models run by revenexx are hosted in EU data centres. A model you or the merchant connect yourselves is not covered | Terms § 18 (5), What an AI agent can change |
| Training on customer data? | Irreversibly anonymised data may be used. The merchant can object at company level at any time | Terms § 29 |
| EU AI Act? | The platform's standard configuration is classified as a limited-risk AI system. revenexx is the provider and the merchant the deployer | Terms § 28 |
| Certifications and penetration tests? | Not published (as of 2026-09) | Confirm with us |
Changes, limits and support
| Question | Answer today | Source |
|---|---|---|
| How are breaking changes handled? | Deprecation, sunset and removal stages, with at least four weeks between the announcement and the removal, announced on the changelog. No response header marks a deprecated endpoint yet (as of 2026-10) | Versioning |
| What are the API limits? | Per-tenant rate limits, with numbers | Rate limits |
| Is the platform up right now? | status.revenexx.com shows current incidents | Get help |
| Where does a question go? | support.revenexx.com. Response times depend on your plan and the priority of the request, and are set in the terms | Get help, Terms Annex 4 |
Where to go next
- Go live with a project: what to settle before a launch.
- Architecture: how a request travels through the platform.
- Get help: where a question goes.