Security
Your compliance data is sensitive.
This is how we handle it.
Sightadel holds risk assessments, policies and evidence – exactly the information attackers are most interested in. That is why we follow the same principles we help you put into practice.
Certified and audited
We practise what we help you with.
neonotu GmbH, the provider of Sightadel, is certified to ISO 9001 and ISO/IEC 27001. It processes data in line with the GDPR and meets the DORA requirements for ICT third-party service providers.
The certificates were issued by an independent body. Sightadel itself does not issue certificates.
Hosting in Germany
Sightadel is hosted in Germany. No detour via data centres elsewhere, no access under foreign law.
Development and support in Germany
Development, operations and support are based here too. The people you deal with speak your language and know your regulations.
Separate tenants
Every organisation works in its own tenant. Consultants with several clients only see that tenant’s data in each one.
Roles and permissions
Six roles separate internal from external and write from read access. Auditors are always external, edit only after approval and can never delete anything.
Complete audit trail
The activity log records who did what and when – from signing in to completing a control.
Processing on behalf
We sign a data processing agreement under Art. 28 GDPR with every customer. We disclose our sub-processors.
Hosting and tenant separation
Hosted in Germany.
Sightadel runs in data centres in Germany. Your data does not leave Germany for the operation of the platform.
Every organisation works in its own tenant. Users, assessments, evidence and logs of one tenant are not visible to other tenants. This also applies to external consultants who work for several clients: they switch between the accounts they have been invited to and only see that account’s data in each one.
For your own documentation, this means you can list Sightadel in your record of processing activities, your vendor assessment and your DORA register of information with a clear location. The sub-processors involved are listed in the data processing agreement.
Development, operations and support are based in Germany. If you would like to know how support access is controlled and logged, we are happy to explain in detail.
Roles and audit trail
Who may do what – and who did what.
Six roles separate internal from external and write from read access. The activity log records who changed what and when.
External roles are by invitation only, and you revoke them with one click. The log also serves as evidence: the auditor sees when a control was edited, a piece of evidence replaced or an action plan completed.
Manages the tenant, users and subscription.
Works on content across all frameworks.
Edits the controls and evidence assigned to them.
Reads along without changing anything.
External consultant, by invitation only.
Always external; comments, creates and edits after approval, never deletes.
Data protection and contracts
Processing on behalf, sub-processors, export.
Whatever you need for your own documentation, you get from us in writing.
Data processing agreement
We sign an agreement under Art. 28 GDPR with every customer. On request, we send it to you in advance for review.
Sub-processors disclosed
The sub-processors are listed in the data processing agreement. We notify you of changes according to the rules agreed there.
Exporting your data
Assessments, evidence and reports can be exported. You are not tied to Sightadel to reuse your work.
Our own ISMS in Sightadel
neonotu GmbH runs its own information security management system in Sightadel. So we use the platform every day, just as you do.
Sign-in
You sign in with your e-mail address and password. We do not currently offer single sign-on.
Vendor questionnaire
Assessing us as a service provider? Send your questionnaire via our contact form. We answer it in full.
Vendor assessment
How to assess us as a service provider.
When you use Sightadel, we are your service provider – and part of your own vendor risk. We make the assessment as easy as possible for you.
- 1
Send your questionnaire
Send us your own questionnaire via the contact form, in whatever format – we will get back to you to arrange the handover. We answer it in full instead of pointing to a standard response.
- 2
Receive the documents
You also get what you need for your documentation: the data processing agreement with the list of sub-processors, and details on hosting and roles.
- 3
Clarify follow-up questions
If an answer is not sufficient for you, ask. We would rather clarify details in a conversation than with wording that says nothing.
- 4
Track it in Sightadel
If you use Sightadel yourself, add us in the vendors area and link the answers as evidence. That way the assessment is ready for your next audit.
Reporting vulnerabilities
Found a vulnerability?
Then we want to hear about it. Write to us via the contact form.
- Describe where the problem is and how it can be reproduced.
- Do not access other people’s data and do not change anything.
- Give us time to fix the problem before you publish it.
- We confirm receipt, review the report and get back to you with the outcome.
Your data belongs to you
Nothing you have not released yourself.
You decide, document by document, what appears in the Trust Center. External consultants and auditors only see what you invite them to.
- Release to the Trust Center for each document individually
- External roles by invitation only
- Auditors without deletion rights
- Sub-processors disclosed
- We answer vendor questionnaires in full
Questions and answers
Questions about security and data protection
More in our FAQ or directly via our contact form.
Where is our data stored?
In Germany. Development, operations and support are based here too.
Who at Sightadel can see our data?
The content of your tenant is meant for your users and the people you invite. We are happy to answer questions about support access and how it is logged in detail – including as part of your vendor questionnaire.
Is there single sign-on?
Not at the moment. You sign in with your e-mail address and password.
Do we get a data processing agreement?
Yes. It is part of every contract. Let us know if you would like to review it in advance.
Can we assess Sightadel with our vendor questionnaire?
Yes, of course. Send us your questionnaire via the contact form – we will answer it in full.
Is Sightadel certified?
The certificates belong to the company behind it: neonotu GmbH, the provider of Sightadel, is certified to ISO 9001 and ISO/IEC 27001. We are happy to answer questions about this as part of your vendor assessment.
Does Sightadel meet the DORA requirements for ICT third-party service providers?
Yes. neonotu GmbH meets the DORA requirements for ICT third-party service providers. We provide the information you need for your register of information and your contractual requirements.
Can we export our data?
Yes. Assessments, evidence and reports can be exported. What happens to your data at the end of the contract is governed by the data processing agreement.
Where can I find the list of sub-processors?
It is part of the data processing agreement. If you would like to review it before signing, we will send it to you.
How do we revoke an external consultant’s or auditor’s access?
An admin removes the person in user management. Access ends immediately; the content and the log of their activity remain in your account.
How do I report a vulnerability?
Write to us via the contact form, with a description of how the problem can be reproduced. We confirm receipt, review the report and get back to you with the outcome.
See for yourself.
In the 14-day free trial, you see roles, audit trail and Trust Center in action – no payment details needed.