1. Status, scope and responsibilities
These Technical and Organisational Measures (TOMs) form Annex II to the Data Processing Agreement of Amerged B.V., Op de Smelen 1, 5863 BN Blitterswijck, the Netherlands, Chamber of Commerce number 42154221, VAT number NL869953308B01. They set the minimum safeguards Amerged shall maintain for the services and Customer Personal Data within its control. They become contractual commitments when incorporated into an accepted Agreement; this document is not an independent audit report or a claim that Amerged holds a certification.
Measures shall be applied proportionately to the processing risks and the managed service boundary. The order shall identify customer-operated components and any additional requirements. A customer-operated component does not remove Amerged's responsibilities for its own processing. The Dutch text is authoritative; the English and German texts are translations. Changes may improve or replace controls but shall not reduce the overall contracted protection.
2. Governance and confidential handling
Amerged shall assign responsibility for service security, privacy coordination and incident response. It shall maintain a proportionate record of relevant systems, data flows, providers and administrative responsibilities. Personnel with access shall be subject to confidentiality duties and receive documented instruction at onboarding and at least annually on data protection, secure handling, phishing, suspicious activity and incident escalation.
Service changes involving personal data shall be considered for security and privacy effects before release. High-risk processing and additional safeguards shall be addressed before activation. Amerged shall review the suitability of these measures at least annually and following material service changes or significant incidents. Reviews and necessary corrective actions shall be documented. An external certification or audit is required only where separately agreed or required by law.
3. Physical protection and working environments
For infrastructure it operates, Amerged shall restrict physical access to authorised persons and protect equipment against loss and unauthorised use. For hosted infrastructure it shall select providers offering controlled building and server-room access, visitor registration or supervision, appropriate fire and environmental protection, and power resilience. Amerged shall assess the relevant contractual information and provider safeguards; these are infrastructure-provider requirements, not a representation that Amerged operates its own data centre.
Devices used for administrative access shall use supported operating systems, security updates, screen locking and device encryption where they store Customer Personal Data or credentials. Personnel shall avoid copying service content to unmanaged personal devices. Printed records, if necessary, shall be access-restricted and securely destroyed when no longer required. Remote work shall use protected devices and encrypted connections.
4. Identity and access control
Amerged shall use individual accounts wherever supported and assign access by role and least privilege. Shared credentials shall be avoided; any technically necessary service account shall have a defined purpose, controlled access and accountable ownership. Administrative access shall use multifactor authentication where supported. Where a component lacks that capability, access shall be constrained through compensating controls such as a protected administrative gateway, key-based authentication and network restrictions.
Access shall require authorisation, be reviewed periodically and be removed promptly when personnel leave or duties change. The assignment, modification and removal of relevant permissions shall be traceable. Elevated access shall be limited to necessary tasks. Passwords shall meet suitable strength requirements, and repeated failed sign-in attempts shall trigger rate limiting or temporary lockout appropriate to the service. Passwords and access keys shall be protected against disclosure; application passwords, where managed by Amerged, shall be stored using suitable one-way password hashing. Suspected compromised credentials shall be revoked or rotated promptly.
5. Transport, storage and secrets
Amerged shall protect personal data in transit over public networks using current supported TLS configurations or equivalent encrypted channels. Connections between a protective edge and the application origin shall also be encrypted with certificate validation. Administrative connections shall use encrypted protocols; unencrypted remote administration shall not be enabled.
Stored customer payloads and backups forming part of the managed service shall be encrypted using established cryptographic mechanisms appropriate to the storage layer. Keys and secrets shall be managed separately from publicly accessible content and source repositories, with access restricted to necessary systems and administrators. Secrets shall not be included in ordinary logs. Key backup, rotation and revocation shall be handled according to risk and service requirements. Encryption does not remove the need for access controls or lawful transfer safeguards.
6. Separation, minimisation and application protection
Customer data shall be logically separated through authorisation boundaries appropriate to the service. Production and development activities shall be separated, and production personal data shall not be copied into testing without a documented need and suitable restrictions. Test data shall preferably be synthetic or anonymised.
Amerged shall limit collected and retained data to what the instructed service requires and use pseudonymisation where compatible with the purpose and technically appropriate. Interfaces shall validate relevant inputs and enforce authorisation before disclosing or changing customer records. Publicly accessible resources shall expose only intended information. Temporary exports and diagnostic copies shall be access-restricted and removed after their purpose ends. Customer-selected integrations shall receive only the content required by the authorised workflow.
7. Network protection and vulnerability management
Core hosting is arranged on Contabo infrastructure in Munich under the agreed deployment specification. Internet-facing protection uses Cloudflare; its edge processing is not represented as exclusively within the EU. Administrative endpoints shall be restricted rather than generally exposed. Firewall and service configuration shall limit network access to necessary functions.
Amerged shall maintain an inventory of relevant software and apply supported security updates. Vulnerabilities shall be assessed and prioritised according to severity, exposure, exploitation evidence and business impact. Urgent risks shall be mitigated promptly, including temporary restrictions where patching is not immediately possible. Material updates shall receive proportionate checks and a recovery or rollback approach. No universal patch deadline or guarantee that all vulnerabilities can be prevented is implied.
8. Logging and detection
Amerged shall retain proportionate records of significant administrative actions, authentication events, operational failures and relevant security events where the service supports them. Logs shall support investigation without unnecessarily recording customer content, credentials or entire prompts. Access to logs shall be restricted and their integrity protected against unauthorised alteration.
Relevant alerts and anomalous activity shall be reviewed according to service risk and operating arrangements. Normal security and operational log retention shall not exceed 180 days from creation. Earlier termination-deletion requirements and shorter agreed periods prevail where applicable. Longer retention requires a documented legal basis or a specific justified incident purpose, restricted access and periodic review; it is not the default.
9. Backups, availability and recovery
For managed persistent customer data, Amerged shall arrange at least daily backups unless the order specifies a different schedule appropriate to the service. Backups shall be encrypted, access-restricted and separated from the primary data sufficiently to reduce the risk of a single operational failure. Backup arrangements shall identify their location and retention; geographic separation shall not introduce an unapproved transfer.
Amerged shall maintain recovery instructions and test restoration at least annually and after material changes that affect recoverability. Results and necessary remedial actions shall be recorded. Backup failures shall be investigated and corrected according to impact. These commitments do not establish a fixed recovery point, recovery time, uninterrupted availability or service-credit scheme; those terms require an express SLA. The Customer shall communicate any critical recovery requirements before contracting.
10. Incidents and continuity
Amerged shall maintain a procedure to identify, escalate, contain, investigate and remediate security incidents. It shall preserve relevant evidence and document material decisions. A personal data breach affecting Customer Personal Data shall be reported without undue delay after awareness, with an operational target of an initial notice within 48 hours. The target shall never justify postponing an earlier possible notice.
Information may be supplemented as the investigation progresses. Amerged shall cooperate with the Customer's lawful response and notification activities, review significant incidents and address identified weaknesses. Continuity arrangements shall cover access to essential recovery information and responsible contacts. Communications shall use the Customer's designated contractual contact. Customers may contact Amerged through the contact form; sensitive details shall use an agreed secure channel. Postal correspondence may alternatively be sent to Amerged's address in section 1, marked “Data protection”.
11. Providers and optional AI processing
Amerged shall assess appointed processors, enter into appropriate processing agreements and maintain the Subprocessor List. Provider safeguards shall be reviewed at least annually and following material changes, using proportionate documentation or other suitable checks. Hosting safeguards shall be considered together with Amerged's own application and operational controls. Provider assurances shall not be presented as certifications of Amerged itself.
For expressly ordered AI services, Amerged shall use AI Act-compliant models through Orq.ai on EU-hosted infrastructure with inference in the EU. Before activation it shall verify and document the requirements applicable to the selected model, its provider, Amerged's role and the agreed use case, including relevant provider documentation and any required transparency, oversight or use restrictions. This commitment applies to the models approved for the ordered service, not every model in Orq.ai's catalogue. Amerged shall configure and document EU endpoints and EU fallback routes, minimise transmitted content and restrict prompt or response logging. Retention, model-provider access and any further providers shall be assessed before activation. Customer Personal Data shall not be used to train general-purpose models. Material model or use-case changes shall trigger a renewed assessment. Departure from the agreed EU inference arrangement requires an express amendment to the applicable order accepted by both parties; an ordinary processing instruction alone is insufficient. Separately authorised support or telemetry transfers remain subject to the applicable transfer safeguards and do not authorise inference outside the EU.
12. Retention, erasure and evidence
Amerged shall maintain procedures for return and secure deletion. Unless earlier deletion is instructed, the Customer shall have a 30-day export period after the services end. Active customer data shall then be deleted within the following 30 days, no later than day 60. Backup copies shall expire within 90 days after active deletion and no later than day 150 after service end. Residual copies shall be restricted to recovery or security, and deletion instructions shall be reapplied after a restoration.
Legally required retention shall be limited, documented and isolated. Own legal-claim records require a separate lawful basis and shall not justify general retention of customer content. Amerged shall make proportionate evidence of measures and remediation available under the DPA's information and audit provisions. A documented service-specific schedule may strengthen these measures; changes shall preserve the DPA's mandatory protections.