How is my data secured?

Your data is encrypted in transit over a secure connection and protected by an SSL/TLS certificate issued and managed by AWS Certificate Manager. Once it arrives in our infrastructure, we encrypt it at rest using AES-256. All of our servers are hosted in Germany, in an AWS data center in Frankfurt am Main — your data is not transferred outside of Germany.

Access to your data within Hypofriend is restricted to the employees who need it to advise you and process your application, and each of them is bound by confidentiality. Your mortgage advisor must use multi-factor authentication to access your data and documents, and we log who accessed your data and when. Our systems are backed up, monitored, and kept up to date with security patches. We regularly review our technical and organizational measures to ensure they remain in line with the GDPR.

We never share your data with third parties without your consent. We do not sell your data, and we do not share it for advertising purposes.

There is one case in which we forward your data, and only with your express permission: when you decide to apply for a mortgage, we transmit your application and supporting documents to the bank partners you have selected so they can assess and process your financing request. This happens only after you give us your approval, and only to the lenders involved in your application. Until then, your data stays with us.

You can withdraw your consent at any time and request access to, correction of, or deletion of your data — subject to the statutory retention periods we are legally required to observe. Full details on how we handle your personal data can be found in our privacy notice.