{ "$schema": "https://doorjames.com/page-schema.json", "url": "https://doorjames.com/security/", "path": "/security/", "language": "en", "locale": "en", "type": "info", "section": "trust", "title": "Security & hosting", "headline": "Hosting, privacy and security controls", "metaTitle": "Security, hosting & data protection | Door James by CGI", "description": "Two hosting options – Google Cloud in Frankfurt or IONOS in Germany –, encryption in transit and at rest, role-based access control, configurable retention periods and a GDPR data processing agreement.", "summary": "Door James runs as SaaS in two architecture variants: the standard on Google Cloud with application hosting in Frankfurt (europe-west3), or the German variant on IONOS with hosting, email and database in Germany. Both variants enforce TLS encryption in transit, encrypt data at rest, apply role-based access control and support configurable deletion and anonymization periods.", "keywords": [ "Security & hosting", "Door James" ], "updated": "2026-09-22", "product": { "name": "Door James", "vendor": "CGI Deutschland B.V. & Co. KG", "vendorUrl": "https://www.cgi.com/", "category": "Workplace management software", "subCategory": "Office management, desk booking, visitor management, space management", "url": "https://doorjames.com/", "pricing": { "currency": "EUR", "price": 2, "unit": "user/month", "minimumUsers": 250, "allModulesIncluded": true }, "hosting": [ "Google Cloud, Frankfurt (Germany)", "IONOS, Germany (option)" ], "languages": [ "en", "de", "fr", "nl", "es", "it", "pt", "fi", "fr-CA" ], "award": "German Innovation Award 2022", "rating": { "value": 4.4, "count": 45, "best": 5, "source": "Apple App Store", "storefront": "DE", "url": "https://apps.apple.com/de/app/door-james/id6444570436", "checkedOn": "2026-09-21", "googlePlayDownloadsMin": 10000 } }, "breadcrumbs": [ { "name": "Home", "url": "https://doorjames.com/" }, { "name": "Security & hosting", "url": "https://doorjames.com/security/" } ], "facts": [ { "label": "Hosting options", "value": "Google Cloud Frankfurt or IONOS Germany" }, { "label": "Transport", "value": "HTTPS and TLS enforced, TLS 1.3 supported" }, { "label": "Roles", "value": "RBAC with organization and location scope" }, { "label": "Availability", "value": "99.5% internal target, not a contractual SLA" } ], "sections": [ { "heading": "Two hosting architectures, documented separately", "level": 2, "text": "Door James runs in two variants, and we keep the statements strictly apart – blending them leads to false commitments in procurement. Google Cloud (standard). The application is hosted in the Frankfurt region, europe-west3. The backend architecture uses Node.js, Express and MongoDB; web and mobile applications communicate over HTTPS. The German data processing agreement names Google (hosting, contracting entity Dublin), Twilio (email services, San Francisco) and MongoDB (database services, Dublin) as subprocessors. It is therefore correct to say that application hosting is in Frankfurt – not that every processing of personal data happens exclusively in Germany. IONOS Germany. For organizations with stronger German data residency requirements, particularly in the public sector, an IONOS variant exists. Its data processing agreement names IONOS SE, Montabaur, for hosting, email and database – each in Germany – and lists no third country in the transfer table. Architecturally it is also public cloud SaaS with containerized application services, load balancing, encrypted transport, encrypted data at rest, monitoring, CI/CD and logical tenant separation. The term “dedicated or private cloud” does not apply to this variant and we do not use it." }, { "heading": "Privacy is configurable, not blanket", "level": 2, "text": "The practically most important privacy capability is configurable retention. Door James lets you define separately when personal references are anonymized and when anonymized or obsolete data is deleted – with different periods for booking data, visitor data and problem reports. In addition, privacy information can be stored per location, which matters for international organizations with differing local requirements." }, { "heading": "Access and tenant separation", "level": 2, "text": "Access in Door James is role-based and additionally scoped by organization and location. Customer data is logically separated; roles and organization context determine what is visible. Administrative access by CGI runs through approved accounts and whitelisting; staff supporting several customers switch into the respective organization context rather than seeing a mixed data pool." }, { "heading": "What we deliberately do not claim", "level": 2, "text": "We avoid a number of statements that circulate in older tender documents: no assurance of a completed CIS benchmark implementation, no independent WCAG/BITV certification, no internal incident targets presented as binding SLAs, no data centre tier claims without evidence. Binding commitments on response or restoration times require a separate written agreement and may carry additional cost." } ], "faq": [ { "question": "Where is data processed?", "answer": "In the standard variant the application is hosted in the Google Cloud region Frankfurt (europe-west3); the data processing agreement names Google plus Twilio for email services (USA) and MongoDB (Dublin) as subprocessors, which is why we do not claim exclusive processing in Germany for that variant. In the IONOS variant the agreement lists hosting, email and database in Germany with no third-country transfer." }, { "question": "Which certifications exist?", "answer": "The technical and organizational measures reference an ISO 27001-oriented ISMS. For statements about hosting provider certificates – such as ISO 27001 or C5 at IONOS – we attach the current provider evidence rather than carrying forward older tender text." }, { "question": "How is data encrypted?", "answer": "In transit through HTTPS and TLS, with TLS 1.3 supported. Data at rest is encrypted; the compliance FAQ identifies AES-256-CBC. For questionnaires requiring exact configuration details we provide current technical evidence." }, { "question": "How often is data backed up?", "answer": "For the GCP architecture the compliance FAQ describes point-in-time recovery within the last seven days, hourly full backups retained for seven days and weekly full backups retained for fourteen days. For the IONOS variant we confirm the values separately before committing to them." }, { "question": "Are there binding RPO and RTO values?", "answer": "Not universally. Door James can address RPO/RTO requirements in contracts, but we do not quote general numbers without reference to the specific hosting package offered." }, { "question": "Which security testing is performed?", "answer": "Regular OWASP ZAP tests and CAST analysis as part of the CI/CD pipeline, complemented by functional testing, regression testing and release validation. At the referenced assessment point there were no critical findings; we explicitly do not generalize that into a claim that no vulnerabilities exist." }, { "question": "Is on-premise operation possible?", "answer": "No. Door James is a standardized public cloud SaaS with logical tenant separation. A dedicated instance is not the standard model and would have to be assessed technically and commercially." }, { "question": "What personal data is processed as a minimum?", "answer": "For core functionality typically first name, last name, email address, the identifier of the booked resource, booking time, check-in and check-out timestamps and the IP address. Activated modules can add further data, for example from visitor or event registration." }, { "question": "Who is controller under the GDPR?", "answer": "Usually your organization as controller; CGI processes the data as processor under a data processing agreement. Legal basis, privacy notices, consents and the correct configuration of retention rules remain your responsibility." } ], "related": [ { "title": "Pricing", "url": "https://doorjames.com/pricing/" }, { "title": "Entra ID & SSO", "url": "https://doorjames.com/integrations/entra-id-sso/" }, { "title": "Workplace analytics", "url": "https://doorjames.com/features/workplace-analytics/" } ], "alternates": { "en": "https://doorjames.com/security/", "de": "https://doorjames.com/de/sicherheit/" }, "formats": { "html": "https://doorjames.com/security/", "markdown": "https://doorjames.com/security/index.md", "json": "https://doorjames.com/security/index.json", "jsonld": "https://doorjames.com/security/index.jsonld" }, "contact": { "email": "doorjames.support@cgi.com", "bookDemo": "https://meet.doorjames.app/public-schedule/99469a6d66d20f7fdd5ee19182a8f8bd", "demo": "https://doorjames.app/demo", "helpCenter": "https://help-center.doorjames.com/hc/door-james/en", "app": "https://wa.doorjames.app" }, "actions": [ { "type": "bookDemo", "name": "Book a demo", "url": "https://meet.doorjames.app/public-schedule/99469a6d66d20f7fdd5ee19182a8f8bd", "minutes": 30, "platform": "Microsoft Teams", "description": "A scheduled call with the Door James team, 30 minutes over Microsoft Teams, slot chosen by the visitor." }, { "type": "liveDemo", "name": "Try the demo yourself", "url": "https://doorjames.app/demo", "description": "Interactive demo environment of the Door James app, no sign-up." }, { "type": "contact", "name": "Contact us", "url": "https://doorjames.com/contact/", "description": "Contact form and email address." }, { "type": "email", "name": "Email", "url": "mailto:doorjames.support@cgi.com" } ], "citation": { "title": "Security & hosting", "publisher": "Door James by CGI", "url": "https://doorjames.com/security/", "dateModified": "2026-09-22" }, "license": "Content © CGI Deutschland B.V. & Co. KG. Quotation and summarisation are permitted with attribution to Door James by CGI and a link to the source URL.", "generated": "2026-10-23", "wordCount": 875 }