Encryption
TLS 1.2 or higher for every connection, HSTS enabled. Data at rest is encrypted with AES-256; database backups are encrypted with a separate key.
Security & data protection
How we handle the data you connect to us
Connecting a sales channel means handing over order, inventory and delivery data. This page describes what we do with it, where it is stored, who can see it and how it is removed again.
Access control
Named user accounts, role-based permissions, mandatory two-factor authentication for all internal staff. No shared accounts, no direct database access from workstations.
Logging
Authentication events, permission changes and data exports are logged with user, timestamp and source. Logs are retained for 12 months and reviewed monthly.
Location
Production systems and backups run in data centres in Germany and the Netherlands. No production data is stored outside the EU.
Separation
Each customer runs in a logically separated tenant. Enterprise customers receive a dedicated database instance. Queries are always scoped to the tenant.
Reviews
Internal security review twice a year, dependency and vulnerability scanning on every release, external penetration test on request under NDA.
Amazon data
Commitments for data received through the Selling Partner API
- Data is used only to provide the service to the seller who authorised the connection.
- Data is not sold, rented, published or used for advertising, profiling or benchmarking.
- Data of one seller is never shared with, or made visible to, another seller.
- Access is limited to the roles listed on the Features page; no additional roles are requested without a documented reason.
- The seller can revoke access at any time in Seller Central. After revocation the platform stops requesting data immediately.
- On termination of the contract, seller data is deleted within 30 days, except records that must be retained under commercial or tax law.
Data processing agreement
Where we process personal data on your behalf — for example the recipient data of your orders — we act as a processor and conclude a data processing agreement under Article 28 GDPR. The agreement is available before signing and forms part of the contract.
No tracking, no advertising
This website sets no marketing cookies, embeds no advertising networks and loads no third-party analytics that profile visitors. Only technically necessary storage is used.
Sub-processors
Current list. Changes are announced at least 30 days in advance so that customers can object.
| Processor | Service | Location |
|---|---|---|
| Hosting provider (EU) | Virtual machines, managed database, object storage | Germany, Netherlands |
| E-mail delivery provider (EU) | Transactional e-mail such as order and alert notifications | Ireland |
| Carrier interfaces | Label generation and tracking events, only for the carriers in your contract | EU |
| Payment and invoicing provider | Invoicing, dunning, payment reconciliation | Germany |
| Eucashbox Logistik GmbH staff | Support and warehouse operations, access limited by role | Germany |
The full names and addresses of the sub-processors are listed in the data processing agreement. No sub-processor is located outside the European Economic Area; if that ever changes, we will inform you in advance and rely on the EU Standard Contractual Clauses.
Retention and deletion
| Data | Retention | Basis |
|---|---|---|
| Order and invoice records | 10 years after the end of the calendar year | German commercial and tax law (§ 147 AO, § 257 HGB) |
| Delivery address and recipient name | 90 days after delivery, then deleted | No longer required once the return period has passed |
| Inventory and listing data | Current plus 24 months of history | Operational traceability |
| User accounts and access logs | Duration of the contract plus 12 months | Security and accountability |
| Support tickets | 24 months after closure | Service history |
| Backups | 35 days rolling | Restore capability |
Deletion requests can be sent to info@eucashbox.com. We confirm deletion in writing, including the deletion from backups once the backup generation has rotated.
Incident response
Suspected security incidents are triaged by the responsible technical lead within two hours during business hours. If a personal data breach is confirmed, we notify affected customers without undue delay and, where we act as a processor, support the controller in meeting the 72-hour notification duty under Article 33 GDPR. A written incident report follows within five business days.
Report a suspected vulnerability or incident to info@eucashbox.com. We acknowledge reports within one business day and do not pursue legal action against good-faith research that avoids data exposure and service disruption.
Business continuity
- Database backups every 6 hours, retained 35 days, restore tested quarterly.
- Infrastructure defined as code, so a rebuild does not depend on manual steps.
- Documented recovery objectives: 4 hours recovery time, 1 hour recovery point for production data.
- Maintenance windows announced at least five business days in advance.
Need the DPA, the sub-processor list or a security questionnaire?
Send us your document and we will complete it, usually within three business days.