Enterprise-grade security and compliance are our foundation
Maesn is ISO 27001 certified and GDPR compliant, built and hosted entirely in Germany. We do not store end-customer data, all infrastructure runs within Europe and security is a first principle across the product and every part of how we operate.
MADE & HOSTEDIN GERMANYDORA-
ready
Security and privacy, built in from the start
Maesn is designed from the ground up around the strictest security and privacy requirements, so you can integrate with confidence.
No data storage
Your customer data is never stored. API calls are processed in real time and passed directly between your system and the target platform.
Encrypted end to end
All data is encrypted in transit. Because calls are processed in real time, there is no end-customer data sitting at rest, and every webhook we deliver is signed so your endpoint can tell a real event from a forged one before it acts on it.
ISO 27001 certified
Maesn is ISO 27001 certified and audited every year. You can find the current certificate in our Trust Center.
GDPR compliant
We run annual GDPR audits and process data to the strictest European standards. Audit reports are available in the Trust Center.
Made and hosted in Germany
All data runs in Microsoft Azure data centres in Germany, with enterprise-grade physical and network security and all infrastructure inside Europe.
Fault-tolerant infrastructure
Resilient infrastructure keeps availability high, even under extreme demand, so your integrations stay online when you need them.
Full compliance documentation, ISO 27001 certificates and GDPR audit reports live in our Trust Center.
The safest data is the data we never hold
Many integration platforms quietly become a second database for your business data. They cache records, sync for performance and keep copies of files for convenience. Maesn keeps none of it.
Every system that stores your customers' data is a liability: another threat vector, more audit scope, another entry in a data processing agreement. Turning that around is the point of the architecture. Your customers' data belongs to you and to them.
One thing is stored. Maesn keeps operational logs, because diagnosing an issue or supporting you when something breaks is impossible without them. They are transient by design, encrypted at rest, and they record that a transfer happened rather than what moved: the endpoint, the response, the timestamp, the target system and the account key. How long they are kept depends on your plan.
Delivering an event is the one step where something waits. While Maesn retries a webhook delivery, the event is held in memory for as long as the attempts run, and it is never written to disk. It is the same rule as everywhere else in the API: data is processed in memory and never stored permanently.
Certifications tell you something about process maturity, but the architecture of the system you integrate is what determines your risk. Because there is no shadow copy of your customers' ledgers here, Maesn's information security risk footprint is fundamentally smaller than that of a platform which keeps one.
Encrypted everywhere, anonymous by design
Security decisions are made early and lived daily, not bolted on later. These four are architectural, which is why they hold for every request.
Encrypted at rest with 256-bit AES
Everything Maesn does store, which means operational logs and credentials, is encrypted at rest. There is no unencrypted data on disk anywhere in the infrastructure.
Encrypted in transit, including internally
All communication with Maesn uses HTTPS, and so does all traffic inside the infrastructure. Plaintext communication is not permitted anywhere.
Hosted in Germany
Every component runs in Microsoft Azure data centres in Germany. No other cloud providers, no third-party tools reading your data, no subcontractors beyond Microsoft.
Anonymous by design
The application layer stores no personally identifiable information in clear text. Tenants and their end users are represented by internal identifiers, not names or email addresses.
The practical consequence is what you can tell your own customers. Even in the event of a breach, whether that means someone listening on the network or physically removing disks from a data centre, the data is encrypted in both states. And because the application layer never holds names or email addresses in clear text, anyone reaching our internal systems would find anonymous identifiers rather than a directory of your users. For a business operating under GDPR, being able to say which route data takes from a bookkeeping system to your platform, and that the answer will not change without your knowledge, is not a minor detail.
Security in the process, not only in the product
Continuous analysis, testing and scanning is what catches a vulnerability while it is still cheap, which is before it reaches production.
Secure by construction
- Every change is peer-reviewed by a person on the team
- Every build runs static and dynamic analysis automatically
- Every build has quality gates, including test coverage requirements
- Everything is deployed to staging and regression-tested end to end
- Containers and cloud infrastructure are scanned for security gaps
Environments kept apart
- Tenants get separate API keys per environment, so a test credential can be shared freely among developers while the production credential stays with the people who need it
- Maesn applies the same separation internally: development, test and production run on fully segregated hardware
- Test data is never stored in the same table, file storage or database as production data
- A leaked credential therefore reaches one environment and no further
ISO 27001 certification is the external check on all of this. It is not a self-assessment: an independent third party audits the processes, the controls and the risk management practices and verifies that how we handle information security matches what we say we do. The same applies to our annual GDPR audits. Every report and control is available in the Trust Center, including the current certificate.
Security questions
Where is Maesn hosted?
Do you store our customers' data?
If you do not store data, what is in your logs?
Is data encrypted at rest as well as in transit?
Do you store personally identifiable information?
How are test and production environments separated?
Is Maesn ISO 27001 certified?
Is Maesn GDPR compliant?
Is data encrypted?
Where can I find your compliance documentation?
Security questions before you integrate?
Talk to our team directly, or visit the Trust Center for all compliance documentation, ISO 27001 certificates and GDPR audit reports.