Data security at DIAVAG.
How the platform protects your data and your clients' data when you work with DIAVAG. DIAVAG is a product of CITO GmbH. This overview is updated continuously.
Last updated: July 2026
Operator and scope
DIAVAG is a product of CITO GmbH. This overview describes how we protect data when you use our website, submit an inquiry, or use the DIAVAG platform for appraisers and its client portal.
It supplements our privacy policy. The privacy policy is authoritative for the processing of personal data.
Data stored in the European Union
All data is stored in the European Union and processed in accordance with the GDPR and the German Federal Data Protection Act (BDSG).
The service providers we use also process data within the EU or on a GDPR-compliant basis. Any transfer outside the EEA takes place only under a permitted mechanism pursuant to Article 46 GDPR.
Encryption
All transmission is encrypted exclusively via TLS (HTTPS). Credentials and sensitive content are stored securely.
Data resides in secured data centers within the EU.
Authentication, access and permissions
Access to the platform requires signing in with a personal account. Recipients in the client portal see only the reports they are authorized to view.
Internally, access follows the principle of least privilege. Accounts are tied to individuals, and permissions are reviewed regularly.
Private file storage with time-limited links
Photos and documents are held in private storage, not under public URLs.
Access is granted through signed links with limited validity. When a link expires, access is re-authorized.
Release log and signature
No report leaves the platform without review and release by the appraiser. Each release is logged with a signature.
Delivered reports can be verified in the portal via QR code and checksum. This makes it possible to prove that a report is unaltered.
AI with no use for training
The platform's AI creates drafts solely from the fields the appraiser has entered. Every statement is tied to a recorded field.
Your data and your clients' data are not used to train AI models.
Your data belongs to you
You remain the data owner. We do not sell your data or share it for advertising purposes.
Reporting security vulnerabilities
If you discover a potential security vulnerability, please contact us at info@diavag.com. We will confirm receipt and get back to you.