Security · Verified 5 September 2026
Hosting, access and backups for your data
Read about Tolus security controls, user permissions and backups. The DPA sets out how data is processed and which subprocessors are used.
Controls in place
The protections in your Tolus workspace
Main hosting in Germany
The application and database run with Contabo GmbH on servers located in the European Union.
Encrypted connections
Connections to the website and application use HTTPS.
Organisation isolation
Business queries are limited to the authorised organisation and project. A client only enters projects to which they are invited.
Role-based access
Owner, administrator, member and client roles have separate permissions. Internal notes remain inside the service team.
Authentication
Users sign in by password or a short-lived, single-use link. Sensitive sending actions are rate limited.
Technical logs
Access and error data needed for security and diagnosis is logged with a stated 12-month retention period.
Agents and API access
Limited, revocable agent access
An AI agent connects to the Tolus MCP server with a token created by the agency. These rules apply whatever the agent.
Hashed tokens
Tokens are stored as SHA-256 hashes, shown only once when created and recognisable by their tolus_mcp_ prefix.
Read-only or write
Each token carries its access level. It can be revoked at any time and its last use stays visible.
Per-project scope
An agent only works in the projects the agency chooses and only sees the tickets assigned to it.
Rate limited
Each token is limited to 120 requests per minute.
No human sign-in
An agent has no password and no reachable email address. It receives no email or notification.
Checked origin
A request sent from a web page on another domain is refused.
Content treated as data
Ticket text reaches the agent as data to analyse, never as instructions.
Current backups
A daily database snapshot, copied off the server
Every night, a snapshot of the SQLite database is checked, then copied to Cloudflare R2, storage separate from the main server. Copies are kept for 30 days.
The transferred copy is verified after upload. A failed backup triggers an alert. The automated snapshot covers the database, not uploaded attachments.
Needs strengthening
Attachments, encryption and restore
Attachments are not yet copied off the server, and the database copy is not encrypted by us before upload. A formal restore test also remains to be put in place.
Data in transit
Encrypted with HTTPS
Browser traffic is encrypted. The database and local backups are not encrypted at rest.
Subprocessors
Published in the DPA
Contabo for hosting, Stripe for payment, Resend for email and Sentry only when error monitoring is enabled.
Audit and certification
No certification claimed
Tolus currently claims no ISO 27001 certification, SOC 2 report or external security audit.
Need an answer before inviting a client?
Describe your security or compliance requirement. We will reply with the product’s current position, including when a requirement is not yet covered.