Julian Melzig
🔒 INTERNAL #17
@Jonas Retry job runs twice. Fix is on you.
Proven in production.
Rehearsed for the worst case.
Etappe has run in daily production since June 2026 — with real data, daily backups and rehearsed restores. And what IT, procurement and works councils ask is answered here, before they ask.
01 · Visibility
One truth. Two views.
Internal notes, estimates and private tickets aren't hidden — they are never delivered in the first place. The customer doesn't receive them: not buried in the page source, not in search, not in the counters.
Team sees #1802
Jonas Beerboom #16
We found the bug, the fix ships today.
Maria Südhoff #15
It comes from the supplier portal.
Customer sees #1802
Internal comment #17 — not visible to the customer
Jonas Beerboom #16
We found the bug, the fix ships today.
Maria Südhoff #15
It comes from the supplier portal.
02 · AI under control
One switch, one meter, one budget.
AI is a product feature with an off switch — not a requirement for using Etappe.
Can be switched off — entirely
One switch per tenant, AI off. Without a stored key the AI features never even start; the rest of the application is untouched.
Hard daily budget
A token limit per tenant, with warnings at 50% and 100% — naming the biggest consumer. It caps the outlier, not the usage.
Usage per feature
Every AI call is attributed to a feature and visible. No credits whose consumption nobody can explain.
Your own key, your own model
Every tenant can store their own API key and choose the model — then requests run on your contract.
Labeled per the EU AI Act
Wherever AI is involved, it says so (Art. 50). What it set glows softly — nothing is adopted unless a human confirms it.
Gaps instead of inventions
If something is missing, Etappe marks the gap instead of filling it. The AI organizes what you wrote — it doesn't invent content.
03 · Operations & data
Germany, the EU — and rehearsed backups.
Hosted in Germany
Operated by us on infrastructure in Falkenstein. On the Enterprise plan on a dedicated instance, separate from all other customers.
Content data stays in the EU
Content data lives exclusively at Hetzner in the EU. Cloudflare sits in front as an edge layer — DNS, certificates, WAF — processing connection data, but running no application code.
Backups that are rehearsed
Daily backups, plus a copy on separate storage outside the instance. Restores are actually rehearsed — most recently on 2026-08-18, integrity check passed.
Sub-processors, named
Hetzner (content data) and Cloudflare (edge layer). Anthropic and Voyage only with AI switched on; Slack, FastBill and Mailgun only with the integration enabled — each can be switched off individually.
Delete and export
Deletion and export functions are built in. The data processing agreement with named sub-processors is available on request.
04 · Access & roles
Being assigned is not having access.
Access is granted, not inherited
Being named on a ticket doesn't grant access to the project. Project access is granted explicitly — roles and access are separate.
Customers manage their own people
A project manager on the customer side invites colleagues by link and deactivates leavers. You are not your customers' user administration.
No self-registration
Accounts come from an onboarding link, a migration or an admin — nobody signs up into your tenant unnoticed.
Passwords, consistently
The minimum length is enforced on every path that sets a password. Migrated legacy passwords keep working and are upgraded to modern hashes on first login.
Evidence, not claims
- Runs in production
- In daily use at an agency since June 2026 — migrated with 14,580 tickets and 96,220 comments
- Restore rehearsed
- 2026-08-18: restore from the separate backup copy, integrity check passed
- Visibility enforced server-side
- Internal content appears nowhere for customers — not in the ticket, not in search, not in the counters
- AI costs are traceable
- Similarity search, 14 days: ≈ $0.02 · reply suggestions, 14 days: ≈ $0.13
PLANNED
Committed, not shipped
Committed and scheduled for the Enterprise plan. It only appears here in the present tense once it has shipped.
SSO (OIDC)
Sign in through your company's identity provider — Entra ID, Google Workspace.
Enforced MFA
Second factor via authenticator app, recovery codes, enforceable per tenant.
SCIM
Provision and deactivate users automatically, straight from your directory.
Session management
See active sessions and devices, end them individually.
Status page
Public operational status with an incident process and maintenance windows.
Frequently asked questions
Does the customer really see nothing of the internal notes?
Nothing. Filtering happens on the server — internal content is never delivered in the first place. Search doesn't find it, and the counters don't count it.
Can we switch AI off completely?
Yes, with one switch per tenant. Without a stored key the AI features never even start. On top of that there's a hard daily token budget.
Where does data go when AI is switched on?
Only then does content go to the model providers — Anthropic for language models, Voyage for semantic search. With your own key you choose provider and model yourself; with the switch off, nothing goes there.
Does rollout involve the works council?
Expect it to: under German law (§ 87 (1) no. 6 BetrVG), software merely capable of monitoring performance or behavior requires co-determination — and a ticket system with AI analysis qualifies. Etappe is built for that conversation: AI can be switched off, usage is transparent, visibility is enforced server-side. Talk to us — we'll support the rollout.
Is there a data processing agreement?
On request — with named sub-processors and advance notice whenever that list changes.
Can we host Etappe ourselves?
No. Etappe is operated by us — on the Enterprise plan on a dedicated instance, separate from all other customers. In return, we rehearse operations and recovery ourselves instead of leaving them to you.
Questions left?
We'll answer the questionnaire.
Send us your IT team's security questionnaire — or start on the free plan and check for yourself.