Security is not a feature. It is a prerequisite.
Security is the cornerstone of anny. As a SaaS solution for booking and resource management, we proactively protect customer data. We constantly review our security protocols to ensure your booking data remains secure and your business remains resilient.
Compliance & Certifications
anny complies with the most important international security standards:
ISO 27001:2022: A certified information security management system (ISMS) that covers all processes, policies and controls for safeguarding company data.
ISO 27017: An additional standard for cloud-specific security controls, ensuring that our cloud operations are secured in accordance with international best practice.
GDPR: All customer data is processed in full compliance with the GDPR. Details can be found in our Privacy Policy.
Our certificates are available for download in the Trust Center.
Our infrastructure is protected by over 17 documented security controls, which are monitored automatically.
Access Control & Authentication
Access to our systems follows the principle of least privilege: every instance of access is restricted to the minimum necessary to perform the task at hand.
Production databases, networks and applications require individual login credentials or authorised SSH keys. No shared accounts.
All remote access to production systems requires multi-factor authentication (MFA) via an encrypted connection.
Access to production databases, operating systems, networks and firewalls is restricted to authorised staff with a proven business need.
Clear guidelines govern the creation, modification and revocation of user rights. Upon offboarding, all access rights are revoked within the defined SLAs.
Network & System Hardening
Network firewalls are actively configured to prevent unauthorised access. Access to the firewall configuration itself is restricted to authorised personnel. Network and system hardening follows documented industry standards, which are reviewed and updated at least annually. Data is encrypted both in transit and at rest.
Monitoring & Logging
A centralised log management system records security-related events and highlights potential threats. All systems are monitored automatically, and real-time alerts are triggered when defined thresholds are reached.
Product safety
Security is built directly into the product, rather than being added as an afterthought. All data storage media containing sensitive customer data are encrypted at rest. Formal policies govern the requirements for vulnerability management and system monitoring for our IT and engineering teams: vulnerabilities are systematically identified, assessed and rectified. At least once a year, we carry out control self-assessments to ensure that all security controls are functioning as intended. If any deviations are identified, corrective measures are initiated and implemented within defined SLAs.
Organisational security
Technology alone is not enough. Security starts with the people who work with it.
Recruitment & Vetting
All new staff undergo background checks before starting work. A binding Code of Conduct is signed as part of the onboarding process. Breaches of this code are dealt with in accordance with a defined disciplinary policy. The same requirements apply to external service providers and contractors: Their contracts also include the Code of Conduct and a confidentiality agreement. Employees also sign the confidentiality agreement as part of the onboarding process.
Security Awareness Training
All employees complete security awareness training within their first 30 days and repeat this at least once a year. This ensures that security awareness is not a one-off event, but an integral part of their day-to-day work.
Physical Security & Access
Visitors to security-sensitive areas must register, wear a visitor pass and are accompanied by authorised staff. Electronic data storage devices containing confidential information are destroyed in accordance with documented procedures, including a certificate of destruction for each device.
Regular Review
Managers carry out performance appraisals at least once a year, which also cover security-related responsibilities.
Data Protection & Data Processing
The protection of your data does not end with encryption. Clear rules govern how data is classified, retained and deleted.
Data classification
A formal data classification policy ensures that confidential information is adequately protected and accessible only to authorised personnel. Different access and processing rules apply depending on the sensitivity of the data.
Data Retention & Deletion
Formal retention and disposal procedures govern the entire lifecycle of company and customer data. Only what is actually necessary is retained. Upon termination of the contract, all confidential customer data is completely removed from the application environment, in accordance with established best practices. Customers retain control over their data at all times and may also request deletion at any time.
GDPR Compliance
anny can be used in full compliance with the GDPR. Personal data is processed solely for the specified purpose and is not disclosed to unauthorised third parties. Full details can be found in our privacy policy.
Business Continuity & Incident Response
We have put in place business continuity and disaster recovery plans and test them regularly. A documented configuration management process ensures that systems can be restored quickly. This is complemented by over 14 internal security procedures, ranging from change management to incident response.
