Security and data protection
An onboarding questionnaire holds the most sensitive data of an employment. This is how onbodi handles it.
Where the data is
The application at app.onbodi.com and all details, proofs and backups are on servers in Germany. There are no services outside the EU in the data flow.
This website (onbodi.com) is delivered separately through Cloudflare. It has no forms and holds no data of firms, clients or employees.
Encryption
- Every connection is encrypted (HTTPS).
- Tax ID, social security number, IBAN and details on residence permit and severe disability are additionally stored encrypted one by one.
- Uploaded proofs are stored encrypted and delivered only through short-lived links, after checking who may see them.
- Backups are made every night, encrypted, and deleted after 14 days.
Who sees what
- Your firm sees its own clients and nothing else. Every query is limited to one firm.
- An employer sees only the employees of their own company.
- Employees see only their own questionnaire. After sending, their link shows only the status, no longer the details.
Signing in
- Firms and employers sign in with a link by email, with no password that could be stolen.
- Two-factor sign-in with an authenticator app is mandatory for everyone at the firm.
- A session ends after 12 hours at the latest.
- Employees get their own random link. Only a fingerprint of it is stored, not the link itself. It is valid for 30 days and stops working as soon as a new one is made.
Audit log
Every view of a person's complete details, every approval, every return and every export is recorded with time and person. Your firm sees the log under Settings.
Emails
Emails from onbodi contain a link and the names of the companies involved, never a person's details. Logs and error reports contain technical identifiers only.
Deletion and cancellation
- Your firm can delete people at any time, with all details and proofs.
- After cancellation you can view and fully export everything for 90 days. Then all of your firm's data is deleted; backups expire 14 days later.
Processing on your behalf
onbodi processes the details on behalf of your firm. We sign a data processing agreement under Art. 28 GDPR with every firm. The service providers for hosting and email are in the EU and are listed in it.
Questions
Write to us at kontakt@onbodi.com.