;fill-opacity:0;'/%3e%3cg%3e%3cg%20transform='matrix(1,0,0,1,136.344705,21.5)'%3e%3cpath%20d='M345,172C345,218.63%20306.63,257%20260,257C213.37,257%20175,218.63%20175,172C175,125.37%20213.37,87%20260,87C306.63,87%20345,125.37%20345,172ZM315,172C315,141.828%20290.172,117%20260,117C229.828,117%20205,141.828%20205,172C205,202.172%20229.828,227%20260,227C290.172,227%20315,202.172%20315,172Z'%20style='fill:rgb(26,26,26);'/%3e%3c/g%3e%3cg%20transform='matrix(1.2,0,0,0.858974,57,47.474359)'%3e%3crect%20x='60'%20y='14'%20width='25'%20height='156'%20style='fill:rgb(26,26,26);'/%3e%3c/g%3e%3cg%20transform='matrix(1,0,0,1,-46,21.5)'%3e%3cpath%20d='M345,172C345,218.63%20306.63,257%20260,257C213.37,257%20175,218.63%20175,172C175,125.37%20213.37,87%20260,87C306.63,87%20345,125.37%20345,172ZM315,172C315,141.828%20290.172,117%20260,117C229.828,117%20205,141.828%20205,172C205,202.172%20229.828,227%20260,227C290.172,227%20315,202.172%20315,172Z'%20style='fill:rgb(26,26,26);'/%3e%3c/g%3e%3cg%20transform='matrix(1,0,0,1,133.689409,21.5)'%3e%3cpath%20d='M530,172C530,218.63%20491.63,257%20445,257C398.37,257%20360,218.63%20360,172C360,125.37%20398.37,87%20445,87C491.63,87%20530,125.37%20530,172ZM500,172C500,141.828%20475.172,117%20445,117C414.828,117%20390,141.828%20390,172C390,202.172%20414.828,227%20445,227C475.172,227%20500,202.172%20500,172Z'%20style='fill:rgb(26,26,26);'/%3e%3c/g%3e%3cg%20transform='matrix(1.022433,0,0,1.022433,122.897905,-6.385636)'%3e%3cg%20transform='matrix(1,0,0,1,-143,23.5)'%3e%3cpath%20d='M856,149.324L856,149.319L856.247,149.077L856,149.324ZM804,149.324C802.993,149.324%20802.176,148.507%20802.176,147.5L802.176,255.176L771.824,255.176L771.824,147C771.824,115.086%20798.086,88.824%20830,88.824C861.914,88.824%20888.176,115.086%20888.176,147L888.176,255.176L857.824,255.176L857.824,147.5L857.82,147.504C857.823,147.337%20857.824,147.169%20857.824,147C857.824,131.643%20845.357,119.176%20830,119.176C814.643,119.176%20802.176,131.643%20802.176,147C802.176,147.179%20802.178,147.357%20802.181,147.534C802.2,148.527%20803.008,149.322%20804,149.324Z'%20style='fill:rgb(26,26,26);'/%3e%3c/g%3e%3cg%20transform='matrix(1,0,0,1,-229,23.5)'%3e%3cpath%20d='M856,149.324L856,149.319L856.247,149.077L856,149.324ZM804,149.324C802.993,149.324%20802.176,148.507%20802.176,147.5L802.176,255.176L771.824,255.176L771.824,147C771.824,115.086%20798.086,88.824%20830,88.824C861.914,88.824%20888.176,115.086%20888.176,147L888.176,255.176L857.824,255.176L857.824,147.5L857.82,147.504C857.823,147.337%20857.824,147.169%20857.824,147C857.824,131.643%20845.357,119.176%20830,119.176C814.643,119.176%20802.176,131.643%20802.176,147C802.176,147.179%20802.178,147.357%20802.181,147.534C802.2,148.527%20803.008,149.322%20804,149.324Z'%20style='fill:rgb(26,26,26);'/%3e%3c/g%3e%3c/g%3e%3cg%20transform='matrix(1,0,0,1,-61,21.5)'%3e%3cpath%20d='M1130,172C1130,218.63%201091.63,257%201045,257C998.37,257%20960,218.63%20960,172C960,125.37%20998.37,87%201045,87C1091.63,87%201130,125.37%201130,172ZM1100,172C1100,141.828%201075.172,117%201045,117C1014.828,117%20990,141.828%20990,172C990,202.172%201014.828,227%201045,227C1075.172,227%201100,202.172%201100,172Z'%20style='fill:rgb(26,26,26);'/%3e%3c/g%3e%3c/g%3e%3c/svg%3e)
Vertrauen
Trust Center
Hier sehen Sie transparent, wie Boomo Ihre Daten schützt, welche Sub-Dienstleister wir nutzen, und welche Sicherheitsmaßnahmen aktiv sind. Diese Seite wird laufend aktualisiert. Stand: 19.8.2026.
Sicherheits-Maßnahmen
TLS 1.3 + HSTS Preload
Alle Verbindungen verschlüsselt, max-age 2 Jahre.
Audit-Log mit Hash-Chain
Append-only, Tamper-Evidence via SHA-256-Chain, Daily-Check-Cron.
PCI-DSS SAQ-A
Keine Kartendaten berühren Boomo-Server, alles via Stripe-Elements.
DSGVO + EAA 2025
Datenverarbeitung in EU, WCAG 2.2 AA Accessibility-CI-Gate.
Sensitive Daten verschlüsselt at-rest
AES-256 in Supabase-Storage + DB.
Multi-Tenant RLS
100% Row-Level-Security auf allen Tabellen, k6-Tenant-Isolation-Test grün.
Sub-Prozessoren
Diese Dienstleister verarbeiten Daten in unserem Auftrag (DSGVO Art. 28). Betreiber werden 30 Tage vor Änderungen informiert.
| Anbieter | Zweck | Standort | Drittland-Transfer |
|---|---|---|---|
| Supabase | Datenbank + Auth + Edge-Functions | EU (Frankfurt) | EU (kein Drittland) |
| Vercel | Frontend-Hosting + CDN | Global Edge | DPF + SCC |
| Stripe Payments Europe Ltd. | Zahlungs-Abwicklung + Connect (Betreiber-Auszahlungen) | EU (Irland) + Global | DPF + SCC |
| Resend | Transaktionale E-Mails (Buchungs-Bestätigung, etc) | Global | SCC |
| Sentry | Fehler-Monitoring + Performance-Tracing (mit PII-Scrubbing) | US / EU-Option | SCC + DPF |
| Google Analytics 4 | Web-Analyse (Consent-gegated, Consent Mode v2) | Global | DPF + SCC |
| Cloudflare Turnstile | Bot-Schutz auf öffentlichen Formularen | Global Edge | SCC |
| OpenAI / Anthropic | AI-gestützte Funktionen (Pricing-Vorschläge, Newsletter-Entwürfe) | US | SCC |
| Mailchimp | Marketing-Newsletter (nur nach Double-Opt-In) | US | DPF + SCC |
SCC = EU Standard Contractual Clauses 2021/914. DPF = EU-US Data Privacy Framework.
Compliance-Status
DSGVO / GDPR
Datenverarbeitung primär in EU. Drittland-Transfers durch SCC/DPF abgesichert.
Verzeichnis nach Art. 30 vorhanden. AVV-Vorlage für Betreiber verfügbar.
PCI-DSS SAQ-A
EAA 2025 (Accessibility)
WCAG 2.2 AA als technischer Standard, automatisierte CI-Prüfung mit axe-core.
Feedback-Kanal: [email protected]
SOC 2 Type 2
Sicherheits-Prüfungen
- Letzter Penetration-Test: geplant Q3 2026 (Cobalt.io Pentester-Pool)
- k6-Load-Tests: 17 Szenarien, alle grün (concurrent-booking, tenant-isolation, payment-webhook-edge-cases, cron-secret, etc)
- Mail-Tester: 10/10 Score (SPF/DKIM/DMARC validiert)
- SSL-Labs: A+ Grade für boomo.io
- Coordinated Vulnerability Disclosure: security.txt
System-Status + Incidents
Live-Status aller Boomo-Komponenten und vergangene Vorfälle:
status.boomo.ioSicherheit melden
Sie haben eine Sicherheitslücke entdeckt? Schreiben Sie uns:
E-Mail: [email protected]
Coordinated Vulnerability Disclosure: /.well-known/security.txt
Wir verpflichten uns zu einer Erstantwort innerhalb von 72 Stunden und einer fairen, transparenten Aufarbeitung. Verantwortungsvolle Offenlegung wird honoriert.