Security and infrastructure
Last updated: 27 September 2026
1. Infrastructure
CatalogHub is operated by forsix GmbH in Germany. The production system, private file storage and backups use infrastructure supplied by Hetzner Online GmbH in Germany or the European Union. This statement does not cover every email provider or access location of recipients worldwide.
2. Safeguards
- encrypted transport over HTTPS with TLS 1.2 and TLS 1.3 and HSTS;
- role- and tenant-based access checks for issuers, customers and forsix administration;
- private file storage and server-side authorisation before downloads;
- CSRF protection, secure session cookies, login rate limiting and password hashing;
- rule-based file and archive inspection with quarantine or human approval;
- daily database and system backups with separate recovery points;
- daily rotation of web and application logs.
The detailed TOM annex is supplied to eligible issuers in the electronic DPA. Security-sensitive details are not published. This page does not promise a particular availability, recovery time, encryption at rest or multi-factor authentication.
3. Government requests
Information and disclosure requests are reviewed for legal basis, authority and scope. Data are disclosed only on an adequate legal basis and only to the legally required extent. Affected customers are informed where legally permitted.
4. Security reports
Concerns may be sent to info@forsix.de. Do not access, alter or publish other parties' data and do not send passwords or unnecessary personal information. This contact channel does not constitute blanket permission for security testing.