Data Protection & GDPR Statement

1. Two Distinct Data Contexts

2. Customer-Controlled Deployment Model

Under the standard CredSecure deployment model, customer credentials, security material, application databases and access records are maintained within the customer's designated infrastructure or landscape and are not centrally hosted by Innodhee.

The customer retains full control over users, roles, scopes, retention, backups, infrastructure, integrations, and credential access.

3. Processor vs Controller Status

Because standard CredSecure deployments remain within the customer's environment and Innodhee does not maintain standing access, Innodhee is not automatically processing the contents of the customer's CredSecure database merely by licensing or supplying the software.

If a specific support, implementation or managed-service arrangement requires Innodhee to process personal data on the customer's behalf, the parties should assess whether processor obligations and a DPA are required for that specific arrangement.

4. Supporting Data Protection Controls

CredSecure includes enterprise capabilities—such as role- and scope-based access control, credential masking, authentication controls, credential lifecycle and expiry visibility, audit traceability, controlled third-party access, and governed credential synchronization/provisioning.

These capabilities may support customers in implementing security and governance controls relevant to their data-protection obligations under GDPR or other applicable frameworks. CredSecure should be described as supporting data-protection controls, not as universally or automatically GDPR compliant by itself.