How amber protects your data

amber runs in German data centres, never trains AI models on your data and respects your access rights. All the evidence – from the DPA to the ISO certificate – is in the Trust Center.

In 3 steps

Open the Trust Center: At amber.de/en/trust-center you'll find every certificate, contract and proof for amber in one place – freely accessible, in English and German.
Download what you need: Under “Documents” you'll find the DPA including TOMs and the security concept, the ISO 27001 certificate and the penetration test certificate, among others.
Pass it on or ask: Forward the documents to your privacy, IT security or procurement team. Something missing? Use the contact form at the bottom of the Trust Center.

What happens to your data

Question	In short
Where is my data stored?	In Telekom's T Cloud in German data centres – with a separate, virtually isolated network environment for each customer.
Does amber train AI models on my data?	No. Customer data is never used to train AI models.
Where do the language models run?	By default in the T Cloud as well. Models from other providers such as OpenAI, Anthropic or Google run exclusively in German or European data centres.
Who sees what?	Your access rights from the source systems still apply, unchanged. In amber you only see what you're allowed to open there.
How is data transferred?	Encrypted, with TLS 1.2 or higher.
What happens when the contract ends?	All data is deleted completely within 30 days of the contract ending – earlier on request.

Tested and documented: amber is ISO 27001 certified, tested by independent penetration tests and built to the requirements of the GDPR, the EU AI Act and SOC 2.

Which documents are in the Trust Center?

Document	What's in it
DPA incl. TOMs	Data processing agreement under Art. 28 GDPR, technical and organisational measures, subprocessors and the security concept
Description of services	Scope of the managed service
ISO 27001 certificate	Proof of the certified information security management system
Penetration test certificate	Proof of the independent penetration test
LLM hosting explained	Where and how the language models behind amber are operated
Data processing and storage	Which data amber processes, where it's stored and for how long
Handling of access rights	How amber takes over the permissions from your source systems
GDPR and EU AI Act overviews	How amber meets the requirements of both
Subprocessors & terms	Every service provider that processes data on amber's behalf, plus the terms and conditions

The standard DPA is ready to download. For an overview of the key safeguards – infrastructure, access, logging, incident management – see “Controls” in the Trust Center.

Good to know

Optional providers are marked. In the subprocessor list, some providers carry an asterisk – Microsoft, Google or Perplexity, for example. They're only used if you use their models or features.
Incidents get reported. amber reports confirmed data protection incidents within 72 hours under Art. 33/34 GDPR.
Security questionnaire or a custom DPA? Get in touch via the contact form in the Trust Center – the team will get back to you promptly.
Question about your account or your permissions? Contact support@amber.de.

Go deeper

For administrators

Was this helpful?