This is a courtesy translation. Only the German version is binding.
Security and data protection at Prilog
As of 30 October 2026
Trust needs rules you can follow
Schools work with information that calls for particular care. That is why Prilog is developed and operated with clear responsibilities, separate school environments and controlled access rights. We document our security measures and review them in ongoing operation.
Our security principles
Every school keeps its responsibilities
The school decides who takes on which tasks and who may access which information. Prilog provides the roles and permissions for this. Professional responsibility for school decisions stays with the people in charge.
School environments are kept separate
Prilog is designed for separate school instances. Additional access and permission controls apply to central technical services. Which components are used for a given school is part of the technical and contractual description.
Permissions follow tasks
People and technical services receive only the access rights they need for their respective task. Administrative access is managed separately and reviewed regularly.
We protect data in transit and access
We apply appropriate security measures to the various services. The specific encryption methods and access options depend on the function used and are documented accordingly.
Operations and recovery are part of the responsibility
Looking after the infrastructure includes security updates, technical checks, secured configurations and procedures for backup and recovery. The effectiveness of these procedures is to be reviewed regularly.
Transparency matters to us
Schools and school authorities can obtain information on data processing, technical and organisational measures, and functions and data flows. We indicate which measures are already verified and which are still being developed.
Which standards guide us
As we develop our security measures, we draw on established frameworks and assess which requirements are relevant to our operations:
- BSI IT-Grundschutz, BSI Standards 200-1 to 200-3
- Guidance for security management, protection requirements, risk analysis and secure servers, networks, containers and applications
- ISO/IEC 27001:2022
- Framework for systematic risk management, clear responsibilities and continual improvement
- ISO/IEC 27002:2022
- Guidance on selecting organisational and technical security controls
- NIST Zero Trust (SP 800-207)
- Access is granted specifically; an internal network is not automatically trusted
- CIS Benchmarks
- Reference for the secure configuration of Linux systems
- OWASP ASVS
- Requirements catalogue for the security of web applications and APIs
- General Data Protection Regulation (GDPR)
- Legal benchmark for risk-appropriate protection of personal data and data processing on behalf
- BSI C5
- Additional criteria catalogue for cloud services whose relevance we are assessing as we grow; there is no C5 attestation
Note: These standards serve as professional guidance. Naming them implies neither ISO/BSI certification nor full confirmation of conformity. On request, we explain the measures actually implemented and verified for the respective scope of service.
Documents for schools and school authorities
For evaluating and introducing Prilog we provide documents in line with the agreed scope of service, including the data processing agreement under Art. 28 GDPR, the technical and organisational measures, descriptions of roles and functions, and information on hosting, sub-processors and data export.
These documents support the school's data protection review and the involvement of the responsible bodies. The legal and organisational assessment depends on the individual school and its federal state or governing body.
Questions about information security?
Please contact info@prilog.team. We will explain how we operate and provide the documents available for your review.