Trust

Data protection and quality assurance

How your raw data reach us, where they are kept, who sees them and when they are deleted. Plus everything QA and procurement need for supplier qualification: quality agreement, questionnaire, audit and DPA.

Intro call Request the DPA

30 minutes on Microsoft Teams with the CovaSyn team. If it is not a fit, we will say so.

Trust · data flowWhat happens to your data

Transferdedicated upload link per order, valid for 30 days
Encrypted in transitTLS 1.2 or higher, HSTS
Evaluation in Germanyonly the scientists on your order see the data
Report to youreviewed before delivery, rights remain yours

Purposeonly your order, set out in the DPA

Deletionon request within 30 days

Your data serve only your order, are kept in Germany and are deleted on request.

What happens to your measurement data

QA and procurement ask this first. Raw data, batch data and structures are among the most valuable things a lab has.

Only for your order
We use your data solely for the agreed order and for nothing else. This commitment sits in the data processing agreement, not just on this page.
Stored in Germany
Your data are kept on servers of Hetzner Online GmbH in Germany, outside any publicly reachable directory. Data held within the EU, no mirroring outside the EU.
Access only for your order
Only the scientists working on your order see your data. We do not pass them on to third parties, except the subprocessors named in the DPA.
Deletion on request
On request we delete your data within 30 days, including backup copies within their rotation cycle, and within 90 days after contract end. Rights to data and report remain entirely yours.

How your data reach us and how they are protected.

Data transfer: For each order you receive a dedicated, secured upload link. It is valid for 30 days and blocked afterwards. If your organisation prescribes its own exchange route, such as a data room, we use it.
Location: Servers at Hetzner Online GmbH in Nuremberg, physically in Germany. CovaSyn is not a subsidiary of a US company.
In transit: Exclusively over TLS 1.2 or higher, with HSTS enabled.
At rest: Storage volumes are encrypted.
Report delivery: Through your customer area, by email as well on request.

Supplier qualification without detours.

We evaluate the measurement data you already have. We do not measure and we do not release anything: assessment stays with your QA, batch certification with your QP.

Quality agreement: Scope, responsibilities, data integrity, reporting of deviations and changes are set out in a quality agreement, on your template if you prefer.
Supplier questionnaire: We complete your company questionnaire. SIG Lite and CAIQ v4 are available fully answered for download further down.
Supplier audit: We arrange an audit on site or by video conference with you.
Review before delivery: Every report is reviewed by a scientist holding a doctorate before it is sent: data basis, calculation and limits of the conclusion.
Traceability: Every report names data basis, method and guideline, such as ICH Q1E or ICH M7. Your QA can recalculate every step from the raw data.
Changes: If a method that can affect results changes, we announce it before it is used in your orders.

What we do not claim

A certified management system. CovaSyn currently holds neither an ISO 9001 nor an ISO 27001 certification and has no SOC 2 report; the controls are documented in SIG Lite and CAIQ v4.
“Replaces your internal data review”. The report supports the review of test data at your site and makes it easier, it does not replace it.
“Released by CovaSyn”. Assessment and decision remain with your QA, batch certification with your QP.
“Passes any audit”. Whether documentation holds up in an inspection is for the authority to decide. We deliver a traceable basis.

Incidents and reports.

Security incidents: A documented reporting path with named responsibilities is in place. Affected customers are informed no later than 24 hours after an incident that may relate to their data is identified. The 72-hour deadline for notifying the supervisory authority under Art. 33 GDPR is part of the procedure.
Report a vulnerability: Reports go to support@covasyn.com. We respond to legitimate reports within 5 business days and follow coordinated disclosure with a 90-day window. The machine-readable version is at /.well-known/security.txt per RFC 9116.
Questions about an order: Questions about ongoing orders, data transfer or the report go to support@covasyn.com.

Security questionnaires, pre-filled.

SIG Lite and CAIQ v4 are fully answered and available here. Together they cover most of what a company-specific questionnaire asks.

Data processing under Art. 28 GDPR

Data processing agreement with the Art. 32 GDPR technical and organisational measures annex and the list of subprocessors, ready to sign usually within one business day via the form on the DPA page. Deletion concept, access concept and incident response plan are provided on request.

Request the DPA

Frequently asked questions

What is our data used for?

Solely for the agreed order. The commitment is part of the data processing agreement.

Where is our data kept?

In Germany, at Hetzner Online GmbH, with data held within the EU.

Do you sign a quality agreement?

Yes. Scope, responsibilities and reporting are set out in a quality agreement, on your template if you prefer. We arrange a supplier audit on site or by video conference with you.

Is CovaSyn certified?

No. There is currently neither an ISO 9001 nor an ISO 27001 certification and no SOC 2 report. The controls are documented in the SIG Lite and CAIQ v4 questionnaires, which you can download on this page.