Security & Privacy
Information security and data protection policies of tolinax UG (haftungsbeschränkt) for the aYOUne platform.
What is inside
Access Control Policy
- **Least privilege:** every person and service receives only the rights required for its task. - **Need to know:** personal data is accessible only to those who need it to perform the service. - **Separation of tenants:** users of one customer can never access another customer's data, unless an exp
Data Classification and Encryption Policy
| Level | Description | Examples | |---|---|---| | Public | Intended for publication | Marketing pages, public documentation | | Internal | Business information without personal data | Product configuration, non-personal statistics | | Confidential | Customer business data and ordinary personal data
Data Retention and Deletion Policy
- Personal data is kept only as long as needed for the purpose it was collected for, or as long as a legal retention obligation applies (for example German commercial and tax law, §§ 147 AO, 257 HGB). - Customers (tenants) are the controllers of the data they process in aYOUne; tolinax deletes or re
Incident Response Policy
This policy defines how tolinax detects, handles, documents and reports security incidents and personal data breaches affecting the aYOUne platform, its infrastructure and the data processed on behalf of customers (tenants).
Information Security Policy
This policy sets out how tolinax protects the confidentiality, integrity and availability of the aYOUne platform and of the data that customers (tenants) and their end customers entrust to it. It is the umbrella document of the information security programme; the sub-policies listed in section 6 con
Internal Data Protection Policy
This policy applies to all employees, contractors and automated agents acting for tolinax. tolinax acts as:
Network Security and Monitoring Policy
- Production runs on Google Kubernetes Engine in europe-west3 (Frankfurt, Germany). The database is a managed MongoDB Atlas cluster in the same region. - All inbound internet traffic enters through a single service-mesh ingress gateway (Istio). Services are not exposed individually to the internet;
Vulnerability Management Policy
- Internal security audits of the code base and infrastructure (a comprehensive audit was carried out in May 2026, with findings tracked and re-verified in June and August 2026). - Reports from researchers and customers through the security contact published in `/security.txt` (security@ayoune.com).
Work with this page
Ready-made instructions for your AI tool. Copy, paste, go — the AI fetches the content itself via the address in the text.
Summarise the steps for me The essentials, in the right order.
Read the following documentation by tolinax UG and work with it.
Source: https://ayoune.com/en/docs/security-privacy.md
Summarise the content for me.
- First, in two sentences: what is this about?
- Then the steps in the order I need to take them.
- One line per step, in plain language.
- At the end: what I should have ready beforehand.
Leave out nothing I need in order to actually finish.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
instead of this snapshot. If not, ignore this point.Explain what I need this for What it is good for — and when it is worth it.
Read the following documentation by tolinax UG and work with it.
Source: https://ayoune.com/en/docs/security-privacy.md
Explain to me what I need this for.
1. Which problem does it solve? In one sentence, from my point of view.
2. Three typical situations in which it genuinely helps me.
3. When I do NOT need it — that saves me time.
4. What I can do instead if it is not a fit.
Stick to what the source says. Where it gives nothing, say so openly instead
of guessing.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
instead of this snapshot. If not, ignore this point.Help me set this up Step by step, asking me as you go.
Read the following documentation by tolinax UG and work with it.
Source: https://ayoune.com/en/docs/security-privacy.md
Walk me through the setup step by step.
- First tell me what I need to have ready (access, data, time).
- Then take me through ONE step at a time. Wait for my "next".
- For each step, say how I can tell that it worked.
- If something goes wrong, ask me for the exact message instead of guessing.
If the instructions leave a point open, tell me so rather than inventing it.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
instead of this snapshot. If not, ignore this point.Help me with a problem Narrow down the cause instead of guessing.
Read the following documentation by tolinax UG and work with it.
Source: https://ayoune.com/en/docs/security-privacy.md
Help me narrow down a problem.
- First ask me what I observe and what I expected instead.
- From that, derive the most likely causes consistent with this source.
- For each cause, give me ONE test that confirms or rules it out.
- Order them so the cheapest test comes first.
Do not guess. If the source does not cover the problem, tell me where I should
look next.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
instead of this snapshot. If not, ignore this point.Explain it in plain words No jargon, from the ground up.
Read the following documentation by tolinax UG and work with it.
Source: https://ayoune.com/en/docs/security-privacy.md
Explain the content so that someone without prior knowledge understands it.
- Start with the purpose: why does this exist at all?
- Explain technical terms in half a sentence on first use.
- One everyday comparison where it genuinely holds — none where it limps.
- At the end: the three things worth remembering.
Do not shorten by dropping conditions. A simplification that hides a
prerequisite is a false statement.
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
instead of this snapshot. If not, ignore this point.A checklist to tick off To follow along while you do it.
Read the following documentation by tolinax UG and work with it.
Source: https://ayoune.com/en/docs/security-privacy.md
Turn this into a **tick-off checklist** for practical use.
- Exactly one action per item, in the imperative.
- Order it so that no item depends on a later prerequisite.
- Prerequisites and pitfalls as indented sub-items.
- End with an acceptance step: how do I know everything is right?
A note on sources:
- Every page of this documentation is available as Markdown (the same address with `.md`).
- A machine-readable overview of all public content is at `/llms.txt`.
- If you have access to the aYOUne MCP server, you can work against live data
instead of this snapshot. If not, ignore this point.