Data residency in Germany
In the IONOS variant the agreement names IONOS SE, Montabaur, for hosting, email and database – each in Germany.
German data residency, EVB-IT and accessibility
For public authorities three topics decide: where the data sits, which contract framework applies and how accessibility is handled.
In short
For the public sector Door James offers the IONOS hosting variant, whose data processing agreement lists hosting, email and database in Germany with no third-country transfer. EVB-IT Cloud is the usual contract framework in procurement; the interface is designed against BITV/WCAG criteria, though without independent certification.
- Hosting
- IONOS Germany, no third-country transfer
- Contract
- EVB-IT Cloud possible as framework
- Accessibility
- designed against BITV/WCAG, not certified
- Operating model
- public cloud SaaS with logical separation
Features
Configurable retention
Separate anonymization and deletion periods for booking, visitor and ticket data, configurable per location.
Visitor management with briefing
Digital confirmation of the privacy notice and safety briefing at check-in, documented and exportable.
Evacuation and first aiders
Presence list and first aider management as a coordination aid – explicitly not a safety-critical system.
The three points where procurement stalls
Data residency. The standard variant on Google Cloud hosts the application in Frankfurt but names subprocessors outside Germany. Where exclusively German processing is required, the IONOS variant is the right route – from the start, not as an afterthought.
Contract framework. EVB-IT Cloud is the relevant framework. Recurring sticking points are the inclusion of provider terms, the liability clause and the symmetry of termination rights. We address these early because they are hard to renegotiate later.
Accessibility. Here we phrase things deliberately carefully: the product is designed against the relevant criteria, and there is no independent certification. Anyone setting a certificate as a mandatory criterion should know that early.
Where we do not bid
We decline when a tender mandates on-premise operation, a physically dedicated instance, unlimited liability, exclusive rights to the core product or source code transfer. That is not a negotiating position but the precondition for Door James remaining a maintainable standard product.
Frequently asked questions
Is processing exclusively in Germany possible?
In the IONOS variant that is the intended position: the agreement lists hosting, email and database in Germany and shows no third country in the transfer table. This explicitly does not apply to the GCP standard variant.
Which certifications does the host hold?
Documents reference ISO 27001 and, in public tenders, C5/BSI-related credentials at IONOS. Before a procurement-critical statement we attach the current provider evidence rather than citing older tender text.
Is on-premise possible?
No. Door James is public cloud SaaS with logical tenant separation. Tenders with a mandatory on-premise requirement are a no-go for us.
What about BITV accessibility?
Door James 2.0 was designed against relevant BITV/WCAG 2.0 criteria. There is no independent certification, and we phrase it that way in procurement documents too.
Does EVB-IT Cloud work as a framework?
Usually yes; EVB-IT Cloud is the relevant framework for cloud services. The concrete contract composition and inclusion of our SaaS terms are clarified during the procedure.
Every industry breaks a booking tool differently
Shift patterns, sites, compliance, who is allowed to sit where. Bring the constraint you think is unusual; it usually is not.