Trust & Security

All customer data (videos, frames, analyses, process sheets, account data) is stored and processed in the European Union. Our database and object storage run on Supabase (AWS Frankfurt, eu-central-1). Videos and extracted frames never leave the EU. AI inference for MTM analysis runs on EU-hosted endpoints.

Data at rest is encrypted with AES-256 using provider-managed keys (Supabase-managed KMS on AWS KMS). Data in transit is protected with TLS 1.2 or higher. Signed URLs for private video and frame downloads are short-lived and single-purpose.

Daily automated database backups with 7-day point-in-time recovery. Object storage is replicated within the EU region. Recovery procedures are tested on a rolling basis.

Row-level security is enforced on every user-facing table. Administrative access is limited to named personnel, gated by two-factor authentication where enabled, and audited. Production database credentials rotate on a defined cadence and are never shared over unencrypted channels.

MTM Vision automatically detects and blurs faces in every uploaded video frame before it is stored for analysis review. Customer content (videos, frames, analyses) is never used to train foundation models. AI providers operate under zero-retention terms where technically available.

Security incidents can be reported to security@mtm-vision.de. We acknowledge reports within one business day. Confirmed personal-data incidents are notified to affected controllers without undue delay and, where required, within 72 hours per Art. 33 GDPR.

A current list of the third-party service providers we use to deliver MTM Vision, including their purpose, data categories and hosting region, is available at /subprocessors.

A GDPR-compliant Data Processing Agreement, including EU Standard Contractual Clauses where applicable, is available on request. See /dpa for details.

MTM Vision exports of Job Element Sheets (JES) follow ISO 9001 documentation principles and are structured to be compatible with VDA 6.3 process-audit evidence requirements. This is an internal alignment statement, not an independent certification.