Your data stays in the EU and in your hands.

Other providers, such as OpenAI, can also be connected. We then point out the consequences for data protection and security.

Permissions arise on three levels. Each is managed where it already lives today.

Which user directory can we connect?

Any that speaks LDAP, OIDC or SAML, for example Active Directory, Entra ID or WSO2. Sign-in runs via Keycloak in basebox; basebox never sees passwords. A second factor is possible.

Who may use which app?

Whoever built the app shares it: with groups from your user directory or with individual people, for use only or also for editing.

Who sees which data?

Each person sees only what they are allowed to see in the respective system anyway. They sign in there via the connection with their own access; basebox uses no shared account.

How does a person sign in to a system?

Via OAuth with their own account in the respective system. basebox receives an authorisation for this, not a password. There is no shared service account.

Where do the groups come from?

From your user directory, for example Active Directory. If something changes there, it also applies in basebox.

What happens when someone shares an app?

What is shared is the task, not the access. Anyone using a shared app still sees only their own data in it.

Who may use which AI model?

Your administrator enables models, like connections to systems. In an app, only an enabled model can be selected.

What may an automated workflow do?

Only what the person starting it is allowed to do. The Workflow Builder, too, can only include connections and models that your administrator has enabled.

Can we set binding rules for everyone?

Yes. Your administrator sets usage policies and system defaults centrally. They apply to all apps in your organisation.

Doctors, psychotherapists and other professional secrecy holders may only involve service providers if these are bound to confidentiality. The agreement under Section 203 of the German Criminal Code (StGB) is an annex to the licence agreement. It is included if you or your staff are professional secrecy holders.

For customers in Switzerland, two annexes supplement the licence agreement and the DPA: a supplement under the Federal Act on Data Protection (FADP, DSG) and a confidentiality agreement under the Swiss Criminal Code. Cantonal and municipal bodies are subject to the data protection act of their canton; the DPA supplement takes this into account.

• Cloud: currently runs in Germany, a country with adequate data protection under Annex 1 of the Data Protection Ordinance (DPO, DSV).
• Swiss data centre: in progress for the cloud, by 2027 at the latest.
• Server: our hardware partner FAST LTA delivers it to Switzerland.
• Processing on behalf: supplement to the DPA under Art. 9 FADP (DSG), including notification of data security breaches under Art. 24 FADP.
• Confidentiality: basebox and all employees involved are bound in writing as auxiliary persons, for professional secrecy (Art. 321 SCC) and official secrecy (Art. 320 SCC).

Anyone using an AI outside their own organisation often removes names and identifiers first. That offers only limited protection:

With basebox, the data stays within your boundaries. The AI works with the complete documents; nobody redacts anything beforehand.

C5 is the BSI's criteria catalogue for cloud services (BSI is Germany's Federal Office for Information Security). Under Section 393 SGB V, cloud providers that process health data need a current C5 attestation. The pre-audit and attestation for our cloud are scheduled. With the server, C5 is not required; your requirements as the operator apply there.

ISO 13485 governs the quality management of medical device manufacturers. A medical device is an application with a medical intended purpose, such as a diagnostic suggestion for a patient. basebox is a platform for general tasks such as drafting letters or searching guidelines. For it, information security is what counts: ISO 27001 and C5.

If you build a medical device yourself and use models from basebox in it, you are the manufacturer. For your technical documentation, we provide the information of a supplier: model register with version and licence, software bill of materials and ISO 27001 certificate.

IT-Grundschutz applies to the operator's information domain, not to a single product. A product therefore cannot be certified under IT-Grundschutz. For your modelling, we provide architecture, data flows, interfaces, roles and logs.