Trust, security, and where your data actually lives.
Plain answers instead of badges. This page lists every provider that touches data, the region it sits in, the measures that protect it, and the commitments we hold. If something you need is missing, ask and we will answer.
Last updated: 25 July 2026
At a glance.
The five questions a German buyer asks first, answered before you have to ask them.
- GDPR
- Compliant, with a signable DPA
- The data processing agreement under Art. 28 GDPR is published in full, not on request.
- Data location
- EU (Frankfurt am Main)
- Application data, funnels, versions, and statistics sit in the EU region.
- Certifications
- None held today
- We say so plainly. What our infrastructure holds is listed further down.
- Cookie banner
- Yes, with reject as easy as accept
- Nothing beyond the strictly necessary runs until you choose. Page views are counted without cookies either way.
- Data protection officer
- Not required
- Below the threshold of Sec. 38 BDSG. Data protection questions go straight to the founder.
Where your data lives.
Four places, and that is the whole list. No data warehouse, no analytics pipeline, no third-party tracking layer.
Application data, EU
Accounts, organizations, funnels, page documents, version history, and aggregated statistics are stored in a Postgres database with Supabase in the EU region (Frankfurt am Main).
Media, EU
Images and files you upload live in Cloudflare R2 object storage in the EU jurisdiction, scoped to your organization.
Delivery, global edge
Published pages are served from Cloudflare edge locations worldwide so a visitor is served from near them. Only the request itself is processed there, not your account data.
AI processing, on request
When you use a generation or editing function, the page content and your instruction are sent to Anthropic for that request. Content sent through the API is not used to train their models under their terms.
The honest residual
Your data sits in the EU, but Cloudflare, Supabase, Clerk and Anthropic are US-owned companies, so US law can reach their group. That is legal under EU Standard Contractual Clauses and, for Clerk, the EU-U.S. Data Privacy Framework, and it is why we say "GDPR-compliant" and never "hosted in Germany". If full EU sovereignty is a hard requirement in your procurement, tell us before you sign, not after.
Subprocessors.
Everyone who can touch data processed on your behalf, what for, and where. We tell you before this list changes, and you can object to a change for a data protection reason.
- Cloudflare, Inc.
Hosting, CDN, edge compute, object storage, custom domains
Global edge / EU storage · DPA + SCCs
- Supabase, Inc.
Database: accounts, funnels, versions, logs, statistics
EU (Frankfurt) · DPA + SCCs
- Clerk, Inc.
Authentication and identity for the client portal
USA · DPA + SCCs + EU-U.S. DPF
- Anthropic, PBC
AI generation and editing of page content, on request
USA · DPA + SCCs, no training on API content
- Stripe Payments Europe, Ltd. / Stripe, Inc.
Subscription payments and invoicing
EU / USA · DPA + SCCs; controller in its own right for payment data
For our own operations
One more provider touches personal data, but not data we process on your behalf: it handles our conversations with you. Listed here because leaving it out is how trust pages become untrue.
- Intercom R&D Unlimited Company
Support chat and product emails. On this website it loads only when you click the chat button.
Ireland / USA · DPA + SCCs
Not subprocessors
Shopify and Meta are connected by you, from your own account, at your instruction. We read order and spend data through your own contractual relationship with them, so they are not our subprocessors. From Shopify we take the order identifier, amounts, and attribution attributes. We do not read or store the names or addresses of your customers.
Technical and organizational measures.
The measures required by Art. 32 GDPR, as actually implemented. This section is the published version of Section 6 of our DPA; the DPA remains the binding text.
Encryption and transport
- TLS/HTTPS for every published page, every portal request, and every API call, with automatic certificate issuance and renewal.
- Storage encryption at rest is provided by the platforms we run on (Supabase, Cloudflare R2).
Access control
- Authentication through a dedicated identity provider (Clerk), with organization and role separation.
- Least privilege: write access is restricted per organization and per plan.
- Secrets are held in the platform secret store, never in the source code or in the repository.
- Access keys for shops and ad accounts you connect are stored in a column that is excluded from all client-side grants. They are readable only by the server role and can never be read back through the portal, by anyone, including us through the UI.
Tenant separation
- Row-level security is enabled on every tenant table in the database, with policies scoped to the acting organization.
- One page equals one attribution key: order and spend data can only ever be attributed inside the organization that owns the page.
- Media objects are stored under organization-scoped identifiers.
Integrity and traceability
- Attribution identifiers in outbound links are HMAC-signed and time-limited, so a click cannot be forged or replayed.
- An audit log records page actions, publishes, and version changes with the acting user.
- Every publish is an immutable version snapshot; any earlier version can be restored with one click.
Availability and resilience
- Pages are delivered from globally distributed edge infrastructure.
- Fault tolerance: if a data source is unavailable, delivery falls back to the last known good state rather than failing the page.
- Rate limiting at the edge on the application and measurement endpoints, plus automated probe blocking.
Data minimization and deletion
- Visitor measurement is aggregate and first-party: views, clicks, and a variant assignment. No cross-site tracking and no advertising networks.
- We do not obtain or store the names, addresses, or contact details of your shop customers.
- Disconnecting an integration deletes the stored access key immediately.
- Account and data deletion is documented and self-serve.
AI handling
- Page content is sent to the model only for the request you triggered, and is not used to train it under the provider terms.
- Fields you lock are never rewritten by any AI pass, including repair and test drafting.
- Your proof and product photography always come from you; where an image belongs, the generator leaves a briefed placeholder for you to fill.
What we commit to.
Straight promises about your data and your brand, no fine print.
Nothing runs before you choose
Statistics and marketing tools stay off until you opt in, and rejecting is a single click on a button the same size as accept. No pre-ticked boxes and no cookie wall. Page views are counted without cookies either way, so we never need to pressure you into a yes.
Your data is never sold or shared
Your data is used to provide the service you booked. There is no second business model behind it.
Your product photos stay yours
Images come from your own media library, and the builder briefs each slot so your real product shows up in your real brand.
Your proof stays yours
Claims and testimonials come from you, and anything you lock is never rewritten, so everything on the page is something you can back up.
Certifications, honestly.
The part most trust pages fudge, so here it is straight.
We hold none today
Sophistication is not ISO 27001 certified and holds no SOC 2 report. Saying otherwise would be false, and in Germany an unfounded certification claim is actionable in itself. We would rather show you exactly what we run and how it is protected than buy a badge we have not earned. When a customer's procurement genuinely requires certification, that is the moment we start the process, and we will say so here.
-
Cloudflare
SOC 2 Type II, ISO 27001, ISO 27701, PCI DSS
-
Supabase
SOC 2 Type II, ISO 27001:2022, HIPAA, PCI DSS
-
Anthropic
SOC 2 Type I and II, ISO 27001:2022, ISO 42001
These are the providers' certifications, not ours, verified on their own trust pages. They say something about the foundation we build on, and nothing about our own audit status.
And what is still open
No external penetration test yet
The platform has been through repeated internal security reviews, with findings fixed and pinned by tests. An independent test is the next step, ahead of any certification.
One person operates this
That means short decision paths and no ticket queue between you and the person who wrote the code. It also means we are candid about it rather than implying a security team that does not exist.
Documents.
All published, none behind an NDA request form.
- Data Processing Agreement (Art. 28 GDPR) The full DPA, including subprocessors, place of processing, and the binding measures.
- Privacy Policy What we process on our own sites and in the portal, on which legal basis, and for how long.
- Terms The general terms and conditions for the service.
- Data deletion How to delete an account, a connection, or the data behind it.
- Legal notice Who runs this, with a real address and a real name.
Found something, or need something?
Security reports, data protection questions, and procurement documents all go to the same address, and reach a person rather than a queue. If you believe you have found a vulnerability, write to us before disclosing it publicly and we will work with you on it.