ClientsOpportunities, quotes, product catalogue
ProjectsPlanning, tasks, sign-off
ServiceHelpdesk, tickets, retainers, assets
TeamPeople, absence, time
MoneyInvoices, e-invoicing, insights
AgentsLeadtime Agent, your own agents, automation
Product · Security
Where your data is kept and who sees it.
Where Leadtime runs, who sees what and what the contract says. The protective measures come from our data processing agreement (DPA).
Where Leadtime runs.
Leadtime runs at DigitalOcean in the Frankfurt am Main data centre (region FRA1).
leadtime.de is hosted on a Hetzner Online GmbH server in the Nuremberg data centre.
Leadtime is a web application. Your team works in the browser.
How your data is protected.
From Annex 1 of the data processing agreement, the technical and organisational measures.
| Measure | What it means |
|---|---|
| MeasureEncrypted transfer | What it meansBetween your browser and the data centre with TLS 1.2. |
| MeasureEncrypted storage | What it meansData in the data centre is encrypted with AES. |
| MeasureBackups | What it meansRegular backups and a recovery plan in the data centre. |
| MeasureAccess on our side | What it meansOur staff get only the permissions they need for their job. Their passwords must be complex, the recommendations of Germany’s Federal Office for Information Security (BSI) serve as a model, and they are never stored in plain text. |
| MeasureReview | What it meansOur external data protection officer reviews the technical and organisational measures every year. |
| MeasureIncidents | What it meansWe notify you without delay once we become aware of a personal data breach. |
Who sees what.
Roles with fine-grained permissions define who sees and changes which areas. Custom roles inherit the permissions of a parent role.
Your clients see only what you share in their guest access: projects, tasks and forms. With the “Log in as member” permission you check what a guest sees.
Every change to a task is in its history. For project documentation, a separate log shows who edited what, when and through which access.
Agents under control.
Every agent has its own account and its own role. It cannot log in to the app, every change appears under its name in the history, and deactivating it locks it immediately.
What an agent may do is set by its role, just like for your team. More under Agents
Who works with your data.
These are the service providers we use for the application. What is agreed on data processing is set out in our DPA. The privacy policy also applies to the website.
| Company | Purpose | Registered office |
|---|---|---|
| CompanyDigitalOcean, LLC | PurposeHosting the application in the Frankfurt am Main data centre (FRA1) | Registered officeNew York, USA |
| CompanyOpenRouter Inc. | PurposeRouting requests to the AI models behind the Leadtime Agent and the AI column mapping in the data import | Registered officeUSA |
For this website
| Company | Purpose | Registered office |
|---|---|---|
| CompanyHetzner Online GmbH | PurposeHosting the website in the Nuremberg data centre | Registered officeGunzenhausen, Germany |
| CompanyOpenRouter Inc. | PurposeRouting requests to the language model behind the assistant on this website. With every request we require that the data is neither stored nor used for training. | Registered officeUSA |
| CompanySlack Technologies | PurposeHanding over to our team when you choose “Talk to a human” in the assistant | Registered officesee privacy policy |
Details on the website are in the privacy policy. Privacy policy
Contracts.
Data processing agreement and terms as PDFs, in German and English, as of 30 September 2025.
If you cancel.
For up to four weeks after the contract ends you can get your data in a common format, and on request we hand it over. One month after the contract ends at the latest, we delete it so that it cannot be restored with reasonable effort.
Questions about security.
Is there a certification?
Best to talk to us about that. What we can document is above: hosting, encryption, backups and the yearly review of the measures. You’ll find the contracts under Legal.
Can we bring our own DPA?
Talk to us. Our DPA, available as a PDF under Legal, is the starting point.
Where do we report a security incident?
Via the contact form or by email to hello@leadtime.de. It goes straight to our team.
Who is your data protection officer?
We have appointed an external data protection officer, Projekt 29 GmbH & Co. KG in Regensburg. Contact details are in the privacy policy.
Question not answered?
Your IT lead or data protection officer can ask us directly. Write to us or book a call.