Security and data protection
Your projects, kept in the EU and under your control
What Vimmersa does to protect unreleased designs and client data, written so your IT or procurement team can check it. Where we fall short, we say so.
What protects your work
Hosted in the EU
The application and its database run on Hetzner servers in Nuremberg, Germany. Your uploaded files are stored in Amazon S3 in Stockholm, Sweden. Vimmersa is operated by BREP STUDIO Sp. z o.o. in Warsaw, Poland.
Encrypted in transit and at rest
Every connection uses HTTPS, and browsers are told never to fall back to plain HTTP. Uploaded files and off-site database backups are encrypted at rest with AES-256.
Two-factor sign-in
Turn on an authenticator app in Console → Security. Sign-in then needs your password and a six-digit code. Ten one-time recovery codes cover a lost phone.
Passwords and sessions
Passwords are stored only as bcrypt hashes. Sign-in is rate-limited per account and per address. Sessions end after 7 days without use and after 30 days at most.
Private until you share
A new tour is private. You decide who sees it: invite people as editors or as viewers who cannot change anything, or send a share link.
Share links you control
Share links carry a long random token, can have a password, and can be revoked at any time. Tour pages ask search engines not to index them.
Continuous backups
The database is streamed continuously to off-site storage and kept for 30 days, with daily backups and daily server images on top.
Scoped API keys
Keys for scripts and assistants are limited to uploads and tours, expire after at most a year, can be revoked, and are stored only as hashes. They never reach billing, account or admin actions.
Who processes data for us
The services that handle data on our behalf. AI providers receive only the image or prompt of a job you start.
| Service | What for | Where |
|---|---|---|
| Hetzner Online | Application servers and database | Germany |
| Amazon Web Services | File storage and backups (S3) | Sweden |
| Stripe | Payments and invoices | EU / USA |
| Resend | Account and notification email | USA |
| Google sign-in (if you use it), Gemini AI tools, map tiles | EU / USA | |
| OpenAI | AI image tools, only when you run them | USA |
| RunPod | GPU processing for panorama and AI jobs you start | Outside the EU |
| Kie.ai, fal.ai, Kling | AI video and image generation, only when you run them | Outside the EU |
| LiveKit | Voice in live guided sessions | Outside the EU |
| Cloudflare | Bot check on public forms (Turnstile) | Global |
What we do not claim
No ISO 27001 or SOC 2 certificate
Vimmersa is not certified. The controls on this page are what we run; we will answer your security questionnaire on that basis rather than point to a certificate.
No single sign-on (SAML) yet
You can sign in with Google or with email and password plus two-factor. Company SSO through SAML or Microsoft Entra is not available.
Displayed images can be saved
Anything a browser shows is on the viewer’s device. Access control decides who can open a tour; it cannot stop someone who can open it from saving what they see.
Questions
Where is my data stored?
In the EU. The application and database are in Germany (Hetzner, Nuremberg); uploaded files and backups are in Sweden (Amazon S3, Stockholm). When you run an AI tool, the image and prompt for that job go to the AI provider listed below; your other files stay where they are.
Do you train AI on my projects?
No. Our terms let us use your content only to provide the service, and we do not use your tours or files to train AI models.
Can I get a data processing agreement (DPA)?
Yes. Write to info@vimmersa.com with your company details and we will provide a data processing agreement under GDPR Art. 28, covering the subprocessors on this page.
Will you fill in our security questionnaire?
Yes. Send it to info@vimmersa.com. We answer from the controls on this page and say plainly where we do not meet a requirement.
How do I delete my data?
Delete a tour from your projects at any time. To close your account and remove everything in it, write to info@vimmersa.com from the account’s address. Backups that still hold it age out within 30 days.
How do I report a security problem?
Email info@vimmersa.com with “Security” in the subject and what you found. We welcome good-faith reports and will tell you what we fixed.
Questions from your IT team?
Send us your questionnaire or ask for the DPA. We answer from what the platform does.