ISMS FAQ#
Our normalized security questionnaire for TryFast: 22 questions buyers ask most often, answered with the controls in place today and what is still on the roadmap.
Last updated: 2026-10-25
TryFast is an A/B testing service operated by subprocess.eu/company, Osloer Str. 83, 13359 Berlin, Germany. See also Compliance, Subprocessors and the Data Processing Agreement. To map your own questionnaire to these answers, use the prompt under "Security questionnaires" on the compliance page.
Certification#
Are you currently certified to ISO/IEC 27001? If yes, please provide the certificate and its scope.
No. subprocess.eu/company does not currently hold an ISO/IEC 27001 certification, and TryFast has no SOC 2 report. Certification is on our roadmap as the company grows. Our hosting provider, Hetzner Online GmbH, operates ISO/IEC 27001 certified data centers; Hetzner publishes its certificate, and we send a copy on request.
Security governance#
Do you operate a formal information security management programme or ISMS?
We operate a documented security program sized for a company with one operator, not a certified ISMS. It consists of: a written architecture and security design (data flows, principals and permissions, tenancy isolation, threat mitigations for hosted JavaScript), defined retention rules for every kind of data, automated security tests that run on every change, a published Vulnerability Disclosure Policy, an incident response procedure with breach notification within 72 hours, and the public documentation on this page and the compliance page. Formalization toward ISO/IEC 27001 is planned.
Data access#
What information belonging to us will you access, process, store, or transmit?
Four kinds of information:
- Data about your website's visitors, collected by the TryFast script only after consent (in the default consent mode) and processed on your behalf: a random visitor id, visit information (visit number, new or returning, traffic type such as organic or paid, device class, browser family), page URLs reduced to origin, path and
utm_*parameters, the referrer's origin, which experiment variation the visitor saw, and the conversions you define (goal key, and optionally revenue, currency, order id and up to 10 properties you choose). IP addresses are received with each request but never stored. Visitor attributes you set in the browser for targeting stay in the visitor's browser. - Your team's account data: name and email address of each member (from the sign-in service), roles, invitations, API key names, connected AI agents, and the activity log of who changed what.
- Your project content: website domains, experiment definitions, the CSS, JavaScript and HTML you write for variations, goals, audiences and results.
- Public pages of your website, fetched only when you or your agent run an installation check or a page inspection on one of your project's domains. The result is returned to you and not stored.
We do not access your servers, databases, analytics accounts or any system other than the pages of your domains that load the TryFast script.
Data location#
In which countries/regions will our data be stored and processed?
In Germany. TryFast is hosted by Hetzner Online GmbH: the production server, which runs the website, app, API, MCP server, script delivery, event collection and both databases, is in Hetzner's data center in Nuremberg, and all backups and raw event logs are stored in Hetzner Object Storage in Germany. Our sign-in service login0 and our inbound mail forwarder run on the same Hetzner infrastructure. Your visitor data and project data are stored and processed only in Germany.
Two providers outside Hetzner handle personal data for us, and neither receives visitor data or project data from our systems. The sign-in service sends account and invitation emails through Amazon Simple Email Service in the AWS region eu-central-1 (Frankfurt). Email you send to our tryfast.eu addresses is forwarded to our support mailbox at Google Workspace (Google Cloud EMEA Limited), which Google states may store and process data in the EU and the US, under the EU Standard Contractual Clauses. The Subprocessors page lists each provider with its location and safeguards.
Access control#
How do you control employee and administrator access to customer data?
TryFast is operated by one named administrator. Server access is limited to that person with SSH key authentication; there are no shared accounts and no password logins on servers. Operator actions (switching off a project, changing a plan) are only possible on a loopback-only interface of the server, with a separate admin token, so they cannot be reached from the internet.
Inside TryFast, access follows least privilege and is enforced on every request:
- Every workspace member has one role: owner, admin, member or viewer.
- API keys and AI agent connections have a permission level (read, build, full) and never exceed the current role of the person who created them; removing a person revokes their keys and agent connections.
- Launches by API keys and agents without full access wait for a person's approval, and only a signed-in person (or the browser that created an unsaved workspace) can approve.
- Every read of an object is filtered by the caller's workspaces in the database query. Objects of other workspaces answer "not found", and an automated test matrix checks this for every route.
MFA#
Is MFA required for privileged accounts and systems containing customer data?
Yes. The operator's accounts with access to production (the Hetzner console and object storage, the domain registrar and the code hosting account) are protected with multi-factor authentication, and server access uses SSH keys instead of passwords. Every TryFast user signs in through the login0 sign-in service, which requires each user to set up two-factor authentication or a passkey at their first sign-in and does not allow skipping it. Workspaces created without an account are reachable only from the browser that created them (an HttpOnly cookie) or with their secret recovery link.
Encryption#
Is customer data encrypted in transit and at rest?
In transit: yes. The website, app, API, MCP server, the script host cdn.tryfast.eu and event collection are reachable only over TLS, with HSTS on tryfast.eu. Backups are transferred to object storage over TLS.
At rest: partly. Every secret is stored only as a SHA-256 hash (API keys, OAuth tokens, recovery tokens, invitation tokens and browser grant cookies), session cookies are HMAC-signed, and the event database stores visitor ids only as hashes computed per project. We do not currently claim disk-level encryption of the server volumes or the backup storage; client-side encryption of backups is on the roadmap. Physical access to the hardware is controlled by Hetzner's ISO/IEC 27001 certified data centers.
Personnel#
Are employees with access to sensitive/customer information subject to appropriate screening, confidentiality obligations, and security training?
The only person with access to production systems and customer data is the operator, Liam van der Viven, who is bound to confidentiality and designed and built the security controls described here. There are no other employees or contractors with access today. Any future team member will sign confidentiality obligations and complete security onboarding before receiving production access, with access limited to what their role needs.
Vulnerability management#
Do you have documented vulnerability and patch-management processes?
Yes, at a scale appropriate to the service. Operating system security updates are applied on a regular cadence, with expedited handling for critical vulnerabilities in exposed services. TryFast is a single program with a small, pinned set of open-source dependencies; we follow security advisories for the Go toolchain and each dependency and update promptly. The script that runs in your visitors' browsers contains only our own code and loads no third-party code. Every change runs static checks and the full automated test suite in continuous integration. Reports from researchers are handled under our Vulnerability Disclosure Policy.
Security testing#
Do you perform vulnerability scanning and/or penetration testing regularly?
Security testing is part of development and runs automatically on every change, including: a tenancy isolation matrix (no route returns another workspace's data), CSRF and origin checks, checks that our outbound fetcher refuses private and internal addresses, rejection of customer JavaScript that tries to break out of its function at publish time, OAuth redirect matching, PKCE and refresh-token reuse detection, a check that stored request replays never contain secrets, and a schema test proving that no database column stores an IP address. No external penetration test has been performed yet; the first one is planned after the launch phase, and its summary will be linked from the compliance page.
Incident response#
Do you maintain and test an information-security incident-response process?
Yes. We maintain a documented incident response procedure: triage, containment (for example switching off an affected project, revoking credentials or rotating secrets), remediation, customer notification and a written post-incident note. Security reports reach the operator directly at security@tryfast.eu. Given the size of the operation, the procedure is exercised through real operational events and restore drills rather than formal tabletop exercises; scheduled exercises are on the roadmap.
Breach notification#
How quickly will you notify us of a security incident affecting our data or services?
Without undue delay, and at the latest within 72 hours of becoming aware of a personal data breach affecting your data, with the information required by Art. 33(3) GDPR as far as it is available, as committed in our Data Processing Agreement. We notify the owners and admins of the affected workspaces by email. Service incidents that do not affect personal data are communicated while they are handled.
Business continuity#
Do you maintain and periodically test business continuity and disaster-recovery arrangements?
Yes, within the limits of a single-server architecture. The main continuity control is that TryFast fails safe for your website: if our servers cannot be reached, the script does not load, visitors see your original pages, and the page is never hidden for longer than the anti-flicker timeout (800 ms by default). Events that cannot be delivered are kept in the visitor's browser and retried for up to 24 hours. The application database is copied every day and before every update, the event database every 6 hours, and raw events are kept for 30 days so the event database can be rebuilt. Today these copies are kept on the production server; copies to separate object storage in Germany are being set up. A restore drill (restore both databases on a fresh server, start the service and compare totals) is documented; it has not yet run against off-site copies. We have no hot standby and do not yet commit to a formal recovery time objective.
Backups#
Are backups performed and tested, and are they appropriately protected?
Partly. Backups are performed: the application database is copied every day and before every update, the event database every 6 hours, and raw event logs are kept for 30 days so the event database can be rebuilt. Today these copies are kept on the production server in Nuremberg. Copies to Hetzner Object Storage in Germany, separate from the server, are being set up (the application database continuously, the event database every 6 hours with 7 days of copies plus 4 weekly copies, raw event logs hourly), transferred over TLS with storage credentials held only by the operator. A restore drill is documented; we will say that restores are tested once it has run against the off-site copies. Deleted data leaves the application database backups within 2 days and the event database backups within 35 days.
Subprocessors#
Do you use subcontractors/subprocessors to deliver the service?
Yes, four: Hetzner Online GmbH (servers in Nuremberg and object storage in Germany), the subprocess mail forwarder (operated by us; relays email sent to our tryfast.eu addresses, inbound only), Google Cloud EMEA Limited (Google Workspace, the support mailbox that receives that email), and Amazon Web Services EMEA SARL through our sign-in service login0 (Amazon Simple Email Service in eu-central-1 for account and invitation emails). Details and changes are published on the Subprocessors page. AI agents you connect and tools you feed from your website's dataLayer are your own choice and your own processing, not our subprocessors.
Supply chain#
How do you assess the information-security risks of your own critical suppliers/subprocessors?
We keep the list short and choose providers for their certifications, locations and data processing agreements: Hetzner for its ISO/IEC 27001 certified data centers in Germany and its Art. 28 GDPR agreement; AWS for its Data Processing Addendum with the EU Standard Contractual Clauses and an EU region for email delivery; Google Workspace, used only for our support mailbox, for its Cloud Data Processing Addendum with the EU Standard Contractual Clauses. Software dependencies are few, pinned to exact versions with checksums, and reviewed on every update. No third-party code runs in your visitors' browsers, and pages we fetch for installation checks and page inspection are treated as untrusted data: they are fetched through a hardened client that refuses internal addresses and are returned as labelled, truncated data, never as instructions.
Changes#
Will you notify us of significant changes to your service, infrastructure, subprocessors, or security controls?
Yes. New or replaced subprocessors are announced on the Subprocessors page and by email to workspace owners at least 30 days in advance, and you may object. Material changes to the service, the terms or our security controls are announced by email at least 30 days in advance where they affect what we committed to.
Compliance#
What security/privacy regulations and contractual requirements apply to the service?
The EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG), as a German company processing personal data in the EU; the German Telecommunications Digital Services Data Protection Act (TDDDG) and the German Digital Services Act (Digitale-Dienste-Gesetz, DDG) for our own website and app; German commercial and tax law for contracts and invoices; and the Art. 28 GDPR Data Processing Agreement that is part of our terms on every plan. Using TryFast on your website, you are responsible for the consent rules that apply to your visitors (ยง 25 TDDDG in Germany and the national rules implementing the ePrivacy Directive elsewhere); TryFast supports this with consent modes, described in Privacy and consent. We do not process payment card data and are not subject to PCI DSS or HIPAA.
Audit evidence#
Can you provide relevant independent assurance reports, such as ISO 27001, SOC 2, penetration-test summaries, or equivalent?
Today we can provide Hetzner's ISO/IEC 27001 certificate for the hosting layer, this FAQ, the compliance page, the Data Processing Agreement with its technical and organizational measures, and the public OpenAPI description of our API. We answer follow-up questions in writing at security@tryfast.eu. We do not yet have our own ISO/IEC 27001 certificate, a SOC 2 report or an external penetration test summary; this page will link them once they exist.
End of contract#
What happens to our information when the contract ends, including deletion, return, backups, and account termination?
Before or at the end of the contract you can export everything through the documented API (projects, experiments with variations and code, goals, audiences, results and the activity log as JSON) and each experiment's results as CSV. When you delete a workspace or project, its scripts stop working immediately, its data is deleted from the application database immediately and from the event database within minutes. Deleted data leaves the application database backups within 2 days and the event database backups and raw event logs within 35 days. Activity log entries are kept for 2 years as an audit trail, also after a workspace is deleted. Invoices are kept as long as German tax law requires (up to 10 years). Deleting your TryFast account is self-service in the app; your login0 sign-in identity is deleted separately in the login0 console. Cancelling a paid plan moves the workspace back to the free plan and keeps its data until you delete it.
Monitoring#
How do you monitor the effectiveness of your security controls and address identified deficiencies?
Service health, error rates and business counters are collected from a metrics endpoint that is reachable only on the server itself, and monitored by the operator. Every deployment ends with automated health checks, including checks that the admin interface and internal metrics are not reachable from the internet. The security tests listed under "Security testing" run on every change, so a regression in a control fails the build before it reaches production. Deficiencies found through monitoring, testing or external reports are tracked by the operator until fixed, and reports reach us directly at security@tryfast.eu.
Past incidents#
Have you experienced any material security incidents relevant to the service in the last 24 months? If yes, what remediation was performed?
No. TryFast launched in 2026 and has had no material security incidents. If one occurs, affected customers are notified as described under "Breach notification" and receive a summary of the remediation.