You probably got here from a "Secured by elvix" badge on a site you use. We're the company that handles your sign-in. No passwords — just passkeys, a 6-digit email code, or Google. We also keep your login history. The app you signed in to never sees your secrets. Here's what that means in plain terms.
When you sign in to an app that uses elvix, your sign-in goes through us. Not the app. We verify your passkey or email code, then tell the app yes or no. The app gets a small signed token that lasts 15 minutes. That's the whole exchange.
So the app never sees your credentials. If the app gets hacked, your identity stays safe with us. If we get hacked, your messages, events, and payments are still safe. They live inside the app, not with us.
No passwords. Passkeys are phishing-proof. Email codes are device-independent. Google is one tap. Your secrets stay on your device — in a German data centre.
A clean split. We don't see what you do inside the app. The app doesn't see your sign-in credentials.
Every right the EU GDPR gives you, mapped to a button you can click. No emails to chase, no forms to fax.
Your data is processed in EU data centres and never leaves.
Your account lives in a Postgres database on German soil. Nothing about your sign-in touches a US sub-processor.
If you ask "where is my sign-in data right now," the answer is one country and one company.
The Postgres database that holds your account sits on delvix. Managed Postgres, EU-only, flat pricing. Built by the same team as elvix.
Continuous backups, 30-day point-in-time recovery, real high availability, zero US data path. We use it for our own product. If we trust it with our auth data, we trust it with our customers' data too.
GDPR Art. 33 + 34 oblige us to act within 72 hours. We commit to faster, and to plain-English communication when it happens.
Monitoring fires within minutes. Engineering on-call acknowledges. Founder paged in parallel.
If credentials were exposed, we rotate tokens and invalidate sessions. If passwords were exposed (which would mean breaking argon2id, practically impossible), we force-reset every affected account.
Every app using elvix is told directly. They have their own relationship with you and coordinate the next message.
The competent supervisory authority is notified within 72 hours per Art. 33 GDPR. For our base in Aachen that's LDI NRW.
If your account is affected and the risk is high, you receive a direct email. No PR-speak. What happened, what we did, what you should do.
Full post-mortem at elvix.is/security/incidents. Timeline, root cause, what changed, what we owe.
You hear from us directly. Not a press release. Not through the app. A plain email to the address on file.
If you're an engineer who landed here from a "Secured by elvix" badge, yes, this is exactly what your end users see. Four lines of code on your side. This trust page on theirs.