Skip to content

Security

Security at a glance

How the connection, stored details, sign-in and backups are protected – and what applies to the data centre.

This page describes the most important protective measures in plain words. The data processing agreement with its annex on technical and organisational measures and the privacy policy are binding.

Little data

Cases do without the name, address, date of birth and health insurance number of the person concerned. The portal’s emails contain no diagnoses and no free texts, but lead into the portal with a link.

Encrypted connection

The connection between your browser and Pflege Patienten is encrypted (TLS); unencrypted requests are redirected to an encrypted connection.

Stored encrypted

Content and free-text fields of the case data – for example diagnoses, care level, short description and services –, messages on a request and team notes are stored encrypted in the database. Fields needed for searching and matching, such as status, postcode, type of care and dates, remain unencrypted. Passwords and recovery codes are only stored as a hash. The portal does not offer end-to-end encryption with keys of the users.

Secure sign-in

  • Each person signs in with a personal account; passwords must have a minimum length.
  • Failed sign-in attempts are limited.
  • A second factor – a code from an authenticator app, plus recovery codes – is mandatory for hospitals. Other organisations can require it for their team; private individuals use it voluntarily.
  • A session ends automatically after a longer period of inactivity.

Backups and operation

  • The servers are backed up daily. A backup is removed at most 30 days after it was created. So that deleted data does not return when a backup is restored, we keep a block list.
  • Security updates of the operating system are installed automatically.
  • For development and tests we only use made-up test data, never data from the portal.

Data centre and certification

Pflege Patienten runs in data centres of Hetzner Online GmbH in Germany. Hetzner is responsible for the physical protection of the data centres, power supply, air conditioning, fire protection and the network; from the operating system upwards, the measures are ours. The information security management system of Hetzner Online GmbH is certified to ISO/IEC 27001:2022 for all hosting services and data centres.

This certification applies to the data centre, not to Pflege Patienten: Pflege Patienten itself is not certified. Documents for your IT department are available on request.

Reporting a security issue

Have you found a possible security issue? Write to info@pflege-patienten.com and briefly describe what you observed. We treat your report confidentially and will get back to you. Please do not publish any details until we have fixed the problem, and do not send any patient data.

Questions about security

Write to us through the contact form – please without patient data.

Read more

Back to the overview