Datargo

APIs as Part of the Supply Chain: Why Interface Security Becomes a Matter of Evidence

Tue, 23 Jun 2026 00:00:00 +0000

Software is rarely a monolith today. Modules, partner services and tenants talk to each other through interfaces, and these APIs are the quiet connectors of the supply chain. NIS2 explicitly requires supply chain security as part of the risk picture. That moves a question long treated as purely technical to the foreground: how secure, and how auditable, are your own interfaces?

The interface is the attack surface

The most common API weaknesses are not exotic exploits but authorization flaws. In the OWASP API Security Top 10, Broken Object Level Authorization sits in first place: an API hands out data without properly checking whether the requesting account is allowed to see it at all. A changed object ID in the request is then enough to retrieve someone else’s records. Three control points decide robustness in practice:

Passkeys in the Enterprise: Phishing-Resistant Sign-In Beyond Passwords and OTPs

Tue, 23 Jun 2026 00:00:00 +0000

Phishing remains the most reliable way into corporate networks, and most second factors do little to change that. A password plus an SMS code, TOTP app or push approval counts as multi-factor authentication, yet at its core it is attackable: lure the user onto a fake page and the second factor can be captured in real time too. FIDO2 passkeys address exactly this point.

Why classic MFA stays phishable

The problem is not the number of factors but their transferability. A one-time code is a shared secret: it works wherever it is entered, including on the phishing page. What is missing is a binding to the genuine counterparty. That binding is precisely what WebAuthn, the standard behind passkeys, provides.

The EU Data Act and the End of Switching Fees: Cloud Switching Becomes Mandatory

Tue, 23 Jun 2026 00:00:00 +0000

Vendor lock-in was long a commercial lever: anyone wanting to leave paid for the exit, fought proprietary formats and lost weeks to migration work. The EU Data Act (Regulation (EU) 2023/2854) reverses that logic. The regulation has applied since 12 September 2025, and its Chapter VI turns switching cloud providers into an enforceable customer right.

What has applied since September 2025

Providers of data processing services (IaaS, PaaS, SaaS) must remove every obstacle that makes switching harder: pre-commercial, commercial, technical, contractual and organisational barriers alike. In practice this means a maximum notice period of two months, a 30-day transition window for the actual move (extendable to up to seven months where technically unfeasible) and the right to take data and digital assets along. For new contracts these duties already apply.

When the Chatbot Has to Identify Itself: AI Transparency in Customer Service from August 2026

Tue, 23 Jun 2026 00:00:00 +0000

Automated first responses, AI-assisted ticket triage, generated reply suggestions: in customer service, AI is already routine. From 2 August 2026 Article 50 of the EU AI Act becomes enforceable, bringing binding transparency obligations for exactly these systems. These duties are distinct from the rules for providers of general-purpose AI models (GPAI): the point here is not the model, but the interaction with people.

What Article 50 requires

At its core sits a disclosure duty. Providers of AI systems intended for direct interaction with people (such as chatbots) must ensure that the person concerned is aware they are communicating with an AI system. The notice must be given at the latest at the time of the first interaction, unless the use of AI is obvious from the circumstances. On top of that, AI-generated or manipulated content must be marked as such in a machine-readable way, and content of public interest that could appear authentic has to be labelled separately.

47-Day Certificates: The CA/Browser Roadmap to 2029

Tue, 09 Jun 2026 00:00:00 +0000

The debate is settled, and part of the outcome is already operational reality: since 15 March 2026, publicly trusted TLS certificates may be valid for at most 200 days, down from 398. That is the first step in a roadmap the CA/Browser Forum adopted in April 2025 with Ballot SC-081v3: unanimously, with 29 votes in favour and none against. At the end of that roadmap sits a maximum lifetime of 47 days.

eIDAS 2.0 and the EUDI Wallet: What Relying Parties Must Prepare by the End of 2026

Tue, 09 Jun 2026 00:00:00 +0000

In about six months a deadline expires that many companies still treat as distant regulation: by 24 December 2026, all 27 EU member states must provide their citizens and residents with at least one European Digital Identity Wallet (EUDI Wallet). The legal basis is Regulation (EU) 2024/1183 (“eIDAS 2.0”), in force since 20 May 2024.

For most companies the more pressing question is not when the wallet arrives, but when they will have to accept it. And that deadline follows immediately.

The Cyber Resilience Act: What 11 September 2026 Means for Makers of Digital Products

Tue, 09 Jun 2026 00:00:00 +0000

In about three months a regulation turns into operational reality. From 11 September 2026 the first binding obligations of the Cyber Resilience Act (Regulation (EU) 2024/2847) take effect, and they happen to be the ones that demand the most process: reporting actively exploited vulnerabilities and severe security incidents. The remaining product and conformity obligations follow with full application on 11 December 2027.

Anyone who manufactures, imports or distributes products with digital elements in the EU should therefore treat September not as a distant date, but as the day a working reporting path has to exist.

Data Sovereignty After the Data Privacy Framework: Why EU Hosting Becomes an Architecture Question

Tue, 02 Jun 2026 00:00:00 +0000

Anyone transferring personal data to the United States has relied since 2023 on the adequacy decision for the EU-US Data Privacy Framework (DPF). In September 2025 the General Court of the European Union (EuG) dismissed a challenge against it, leaving the framework a valid legal basis. But the matter is not closed: in late October 2025 an appeal was lodged with the Court of Justice (Case C-703/25 P). Another reversal, a “Schrems III”, is not ruled out.

The EU AI Act: GPAI Enforcement from 2 August 2026 and What the Digital Omnibus Postponed

Tue, 26 May 2026 00:00:00 +0000

The EU AI Act has been in force since August 2024, but many of its obligations take effect in stages. One date stands out: on 2 August 2026 active enforcement against providers of general-purpose AI models (GPAI) begins through the EU AI Office, and national sanction regimes take effect in parallel. In Germany the accompanying AI Measures and Innovation Act (KI-MIG) applies. Anyone who uses or provides AI should know the deadline, but also the most recent postponements.

SD-JWT VC and OpenID4VP: The Protocols Behind the EUDI Wallet

Tue, 12 May 2026 00:00:00 +0000

Most of the conversation around the EUDI Wallet sits at the political and organisational level: member-state provisioning by the end of 2026, registration duties, acceptance deadlines. But anyone who actually wants to accept the wallet eventually faces a technical question: how exactly do I verify that a presented attribute is genuine, valid and sufficient for my purpose? This article looks at the verification side and the building blocks that come together there.

Archiving Structured E-Invoices the GoBD Way: The Eight-Year Question

Tue, 21 Apr 2026 00:00:00 +0000

The debate around e-invoicing mostly turns on issuing and receiving. The quieter but longer-lived obligation only begins afterwards: retention. A structured invoice is not a document in the classic sense but a data set, and it must remain unalterable and machine-readable for years. Building that into your processes from the start avoids costly rework later.

What changed about the retention period

For a long time, accounting records had to be kept for ten years. Germany’s Fourth Bureaucracy Relief Act (BEG IV) shortened this to eight years as of 1 January 2025. The new period applies to all records whose previous ten-year period had not yet expired at that point.

NIS2 in Practice: From Reporting Duty to Defensible Evidence

Tue, 14 Apr 2026 00:00:00 +0000

Since 6 December 2025, NIS2 is law in Germany. The NIS2 Implementation and Cybersecurity Strengthening Act (NIS2UmsuCG) was passed by the Bundestag on 13 November 2025, confirmed by the Bundesrat on 20 November, and entered into force with no transition period. Around 29,500 companies across 18 sectors are in scope. The BSI registration deadline on 6 March 2026 has passed; late registration remains possible and is advisable.

Many organisations treated the rollout as a registration and documentation task. The harder part begins afterwards: being able to prove, when it counts, what actually happened.

ACME Beyond the Web Server: Certificate Automation for Internal Services and mTLS

Tue, 17 Mar 2026 00:00:00 +0000

Shortening public TLS lifetimes towards an eventual 47 days has created an awareness that manual renewal no longer scales. What often gets overlooked: inside a company there are usually far more certificates than at the outward-facing edge. Service-to-service communication, mTLS in a service mesh, internal APIs and database connections all live on certificates, and these follow different patterns than the public web.

Why “internal” does not mean “simpler”

At the public web server the situation is tidy: a handful of domains, a public CA, a clearly defined validation path. Internally the ratio inverts. Here there are often hundreds or thousands of short-lived endpoints that appear and vanish dynamically, for instance when an orchestrator starts new containers. An internal CA issues certificates for them that nobody sees publicly, but which expire just the same, must renew just the same, and take down a service just the same when they fail.

DORA for ICT Providers: Third-Party Risk and Incident Reporting

Tue, 09 Dec 2025 00:00:00 +0000

DORA, the Digital Operational Resilience Act (Regulation (EU) 2022/2554), has applied to the European financial sector since 17 January 2025. Since 19 November 2025, oversight has become concrete: the European Supervisory Authorities EBA, EIOPA and ESMA published the first official list of 19 ICT third-party providers designated as critical, among them AWS, Google Cloud, Microsoft, Oracle, SAP, IBM and Deutsche Telekom. The list is updated annually.

The instinctive reaction of many IT providers is: this does not concern me, I am not a bank. That is a fallacy. DORA travels down the supply chain.

Post-Quantum Cryptography: Why the Migration Starts in 2026, Not 2030

Tue, 16 Sep 2025 00:00:00 +0000

Since August 2024, the first three post-quantum standards have been final. NIST published FIPS 203 (ML-KEM, derived from Kyber), FIPS 204 (ML-DSA, from Dilithium) and FIPS 205 (SLH-DSA, from SPHINCS+), concluding an eight-year selection process. Many read the headline, see the frequently cited year 2030 and put the topic back on the shelf. That is a misunderstanding: 2030 is a deadline, not a starting gun.

“Harvest now, decrypt later” makes it urgent

The threat does not wait for the first capable quantum computer. Attackers intercept encrypted traffic today and store it to decrypt later. Anything that must stay protected for a long time is therefore already exposed: contracts, health and HR data, long-lived keys, intellectual property, state and trade secrets. For this data, what matters is not when a quantum computer becomes practical, but how long the data must remain secret.

Germany's E-Invoicing Mandate: The 2025 to 2028 Roadmap Without the Myths

Tue, 11 Feb 2025 00:00:00 +0000

Since 1 January 2025, e-invoicing in German B2B business is no longer optional. The first stage of the new mandate is in force: every domestic company must be able to receive structured electronic invoices. Issuing them electronically is not yet compulsory, but receiving them is. The legal basis is the Growth Opportunities Act (Wachstumschancengesetz), passed by the Bundesrat on 22 March 2024; the details are set out in the Federal Ministry of Finance guidance of 15 October 2024.

Addendum for Regulated Customers (DORA / NIS2)

Mon, 01 Jan 0001 00:00:00 +0000

1. Subject Matter, Scope and Relationship to Other Documents

(1) This Addendum for regulated customers (hereinafter the “Addendum”) supplements the General Terms and Conditions of Datargo GmbH, Frankfurt am Main (hereinafter “Datargo”), with those contractual mandatory contents that are required for regulated customers under Regulation (EU) 2022/2554 (Digital Operational Resilience Act, hereinafter “DORA”) and under Directive (EU) 2022/2555 (hereinafter “NIS2”) as well as their respective national implementation.

(2) This Addendum applies exclusively to customers that are

Book a call

Mon, 01 Jan 0001 00:00:00 +0000

Careers

Mon, 01 Jan 0001 00:00:00 +0000

What we are working toward

Datargo brings together monitoring, customer service, identity, accounting, and certificates in one platform, EU-hosted and auditable by design. We are building it for organizations that understand digital sovereignty not as a buzzword, but as a requirement.

How we work

Small, accountable teams with a direct line to customers
Native apps and platform services, without wrapping and without compromises on security
Made in Germany, operated on our own European infrastructure

Who we are looking for

We are always glad to hear from people in engineering, security, product, and customer support who take regulated industries seriously. We post open positions here as soon as they become available.

Customer Voices

Mon, 01 Jan 0001 00:00:00 +0000

References from regulated industries

Our first customers work in financial services, the public sector, healthcare, industry and SaaS. In these industries, references are only named once confidentiality and approvals allow. We build them up carefully instead of advertising with logos that we cannot substantiate.

The Design Partner Program

We are looking for pilot customers who adopt the Datargo suite early and help shape it:

A direct line to the product team and influence on the roadmap
Guided onboarding of Datargo Monitor, Datargo CRM and Datargo ID
Preferential terms for the pilot phase
A joint case study once results are available and approved

Is this a fit for you?

If you are looking for a sovereign, EU-hosted platform with audit evidence and you are ready to get on board early, we would be glad to talk.

Data Processing Agreement (DPA)

Mon, 01 Jan 0001 00:00:00 +0000

1. Preamble and allocation of roles

(1) This Data Processing Agreement (hereinafter the “DPA”) sets out in concrete terms the data protection rights and obligations of the parties in connection with the processing of personal data that Datargo GmbH, Frankfurt am Main (hereinafter “Datargo” or the “Processor”), carries out on behalf of and in accordance with the instructions of the customer (hereinafter the “Customer” or the “Controller”) in the course of providing the modules Datargo Monitor, Datargo CRM, Datargo ID, Datargo ERP and NextPKI as well as the bundled offering Datargo One (individually and collectively hereinafter the “Services”).

Datargo CRM

Mon, 01 Jan 0001 00:00:00 +0000

Datargo ERP

Mon, 01 Jan 0001 00:00:00 +0000

Datargo ID

Mon, 01 Jan 0001 00:00:00 +0000

Datargo Licensing: General Terms and Conditions and End User Licence Agreement (EULA)

Mon, 01 Jan 0001 00:00:00 +0000

General Terms and Conditions (GTC) and End User Licence Agreement (EULA) of Datargo GmbH for the acquisition and use of Datargo Licensing products

As of: 1 June 2026

These terms apply to all software products distributed through the direct software business of Datargo GmbH (Datargo Licensing), in particular sqlclient and FoldMail, which are obtained through the License Center (license.datargo.com). They consist of Part A (product-neutral GTC for the acquisition contract), Part B (product-neutral End User Licence Agreement/EULA for the rights of use) and Part C (product-specific schedules of services for each product). The terms apply to consumers and entrepreneurs alike.

Datargo Monitor

Mon, 01 Jan 0001 00:00:00 +0000

Documentation

Mon, 01 Jan 0001 00:00:00 +0000

Where to start

The Datargo suite is modular. Each module can be adopted individually and connected through open standards.

Datargo Monitor: checks for HTTP, DNS, TLS, TCP, SMTP, Ping, and Traceroute, an incident engine, and an audit trail.
Datargo CRM: an embeddable chat widget, tickets and contacts, multi-tenant.
Datargo ID: central sign-in and Single Sign-On for all modules.
Datargo ERP: invoicing per EN 16931, export, and integration.
NextPKI: management and issuance of certificates.

Integration and operations

All modules speak open standards and can be exported and connected. Single Sign-On runs through Datargo ID, billing through Datargo ERP. Your data stays EU-hosted and remains exportable at any time.

General Terms and Conditions

Mon, 01 Jan 0001 00:00:00 +0000

1. Scope and order of precedence

(1) These General Terms and Conditions (hereinafter “GTC”) apply to all contracts between Datargo GmbH, Frankfurt am Main (hereinafter “Datargo”), and its business customers (hereinafter “Customer”) concerning the provision and use of the modules Datargo Monitor, Datargo CRM, Datargo ID, Datargo ERP and NextPKI, as well as the bundled offering Datargo One (individually and collectively hereinafter “Services”).

(2) Datargo’s offerings are directed exclusively at entrepreneurs within the meaning of section 14 BGB (German Civil Code), at legal persons under public law and at special funds under public law. The conclusion of a contract with consumers within the meaning of section 13 BGB is excluded. The Customer warrants that it is concluding the contract in the exercise of its commercial or independent professional activity.

Legal Notice

Mon, 01 Jan 0001 00:00:00 +0000

Provider

Datargo GmbH Omniturm, Neue Mainzer Straße 52-58 60311 Frankfurt am Main, Germany

Managing Director: Andreas Mallek

Contact

Email: hello@datargo.com

Register Entry

Registered in the commercial register:

Registering court: Friedberg Local Court (Amtsgericht Friedberg)
Register number: HRB 9742
VAT identification number pursuant to Section 27a UStG: DE320115003

The address shown above in the Omniturm (Frankfurt am Main) is the business address. The company’s registered seat lies within the district of the Friedberg Local Court (Amtsgericht Friedberg, Wetteraukreis).

NextPKI

Mon, 01 Jan 0001 00:00:00 +0000

Partner Program

Mon, 01 Jan 0001 00:00:00 +0000

Who the program is for

System integrators and IT service providers who want to add a sovereign, EU-hosted alternative to US platforms to their portfolio.
Implementation partners who roll out monitoring, customer service, identity and accounting in mid-sized companies and large enterprises.
Managed service providers who offer Datargo Monitor and Datargo CRM as a fully managed ongoing operation.

What working together looks like

Refer. You recommend, we deliver and operate. For every referred contract you receive recurring compensation.

Privacy Policy

Mon, 01 Jan 0001 00:00:00 +0000

1. Overview and scope

(1) This privacy policy informs you about how Datargo GmbH (hereinafter “Datargo”, “we” or “us”) processes personal data arising from the visit to and use of this website as well as the functions directly connected with it (such as making contact and live chat). It is addressed to all persons whose data is processed in this context (hereinafter “data subjects” or “you”).

(2) Personal data means any information relating to an identified or identifiable natural person (Art. 4 No. 1 GDPR). The relevant legal bases are in particular the General Data Protection Regulation (GDPR), the Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) and the Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG).

Service Level Agreement (SLA)

Mon, 01 Jan 0001 00:00:00 +0000

1. Subject matter, scope and delimitation

(1) This Service Level Agreement (hereinafter “SLA”) is an annex to the General Terms and Conditions of Datargo GmbH (hereinafter “Datargo”) and specifies in detail the availability of the Datargo services governed in Section 6 of the General Terms and Conditions (Datargo Monitor, Datargo CRM, Datargo ID, Datargo ERP and NextPKI as well as the bundled offering Datargo One, individually and collectively hereinafter the “Services”).

Special Conditions Datargo CRM

Mon, 01 Jan 0001 00:00:00 +0000

1. Applicability, relationship to further documents and order of precedence

(1) These special conditions (hereinafter “Special Conditions CRM”) apply exclusively to the use of the Datargo CRM module and supplement the General Terms and Conditions of Datargo GmbH (hereinafter “Datargo”). They are addressed exclusively to entrepreneurs within the meaning of section 14 BGB (German Civil Code), to legal persons under public law and to special funds under public law.

(2) Insofar as these Special Conditions CRM and the General Terms and Conditions conflict in the context of Datargo CRM, these Special Conditions CRM shall prevail. In all other respects, the General Terms and Conditions, in particular the liability provision set out therein (Section 9 of the General Terms and Conditions), shall remain unaffected and shall apply on a supplementary basis. Any reference in these Special Conditions CRM to “the liability provision” refers to Section 9 of the General Terms and Conditions.

Special Terms Datargo Monitor

Mon, 01 Jan 0001 00:00:00 +0000

1. Scope, Relationship to Other Documents and Order of Precedence

(1) These special terms (hereinafter “Special Terms Monitor”) apply exclusively to the use of the Datargo Monitor module and supplement the General Terms and Conditions of Datargo GmbH (hereinafter “Datargo”). They are directed exclusively at entrepreneurs within the meaning of Section 14 BGB (German Civil Code), at legal entities under public law and at special funds under public law.

(2) Insofar as these Special Terms Monitor and the General Terms and Conditions conflict in the context of Datargo Monitor, these Special Terms Monitor shall prevail. In all other respects the General Terms and Conditions, in particular the liability provision set out therein (Section 9 of the General Terms and Conditions), remain unaffected and apply on a supplementary basis. Any reference in these Special Terms Monitor to “the liability provision” refers to Section 9 of the General Terms and Conditions.

Status

Mon, 01 Jan 0001 00:00:00 +0000

How we measure availability

Datargo confirms availability across multiple regions from Frankfurt, North America and Asia. Only once several regions confirm an outage does the incident engine trigger. This eliminates false alarms and makes every incident traceable in the audit trail, as NIS2 evidence.

Where you see live status

Inside the product, you see availability, open incidents and response times in real time, per organization and per module. Datargo Monitor delivers the same view for your own services and suppliers.

Sub-Processors

Mon, 01 Jan 0001 00:00:00 +0000

1. Subject Matter and Relationship to the Data Processing Agreement

(1) This overview lists the sub-processors (hereinafter “sub-processors”) that Datargo GmbH, Frankfurt am Main (hereinafter “Datargo”), engages for the processing of personal data of its business customers in connection with the provision of the modules Datargo Monitor, Datargo CRM, Datargo ID, Datargo ERP and NextPKI, as well as the bundle offering Datargo One (individually and collectively hereinafter the “Services”).

(2) This overview forms part of the Data Processing Agreement (DPA) pursuant to Art. 28 GDPR and gives concrete effect to its Section 7 (engagement of further processors). To the extent there are conflicts between this overview and the DPA, the DPA shall prevail in matters concerning the processing of personal data. Where an individual agreement deviates from this overview, that individual agreement shall prevail (Section 305b BGB (German Civil Code)). This provision applies exclusively in relation to entrepreneurs within the meaning of Section 14 BGB, to legal persons under public law and to special funds under public law (purely B2B).

Trust Center

Mon, 01 Jan 0001 00:00:00 +0000

Hosting and data location

Datargo runs exclusively within the European Union. The default location is Frankfurt am Main. Region pinning and on-premises options are available through Datargo One. All customer data processed on your behalf stays in the EU; only the app push notifications (Apple) and payment processing (Stripe) run via US providers certified under the EU-US Data Privacy Framework. No other third-country transfers without appropriate safeguards.

Security

Strict tenant isolation, enforced consistently across the platform
Tamper-evident, append-only audit trail
Access control with MFA and step-up authentication for sensitive actions
Encryption in transit and at rest

Compliance

Datargo supports evidence for NIS2, DORA, ISO 27001, GoBD and e-invoicing per EN 16931. ISO 27001 certification is in progress; the current status is published here.