Security and data: check it yourself.

• Microsoft is used only for sign-in and to check that a person works at your company. Comrido does not call Microsoft Graph and has no access to mail, calendars, files, contacts, the directory or Teams chats.
• Your company receives no information about individual people. There is no employer dashboard with personal data.
• Hosted on a server in Germany (dogado GmbH, Leipzig). Comrido holds no certification (ISO 27001, SOC 2, TISAX) and does not claim one.
• What is still missing today is listed plainly in the section "What is still missing".

• At sign-in Comrido requests these scopes: openid, profile, email and its own access_as_user scope of the Comrido API. Nothing more.
• From the token Comrido reads only your organisation's id, the account id and the work e-mail address. Comrido does not read the name; people enter their display names themselves.
• The access_as_user scope identifies the browser or Teams to the Comrido API. It gives no access to data at Microsoft.
• The API checks every token: signature against the tenant's keys, issuer, audience and scope. Only companies we have switched on can sign in; any other tenant is turned away.
• The Teams app is a single personal tab with exactly one domain. It has no device permissions (camera, microphone, location), no bot, no message extension and no permissions for chats or channels.
• How you can check this: Microsoft's consent screen at first sign-in lists the permissions. In the Teams admin centre, Teams apps → Manage apps → Comrido shows version, permissions and domain; the ZIP file contains the readable manifest.json. In Entra ID, Enterprise applications → Comrido → Permissions shows what your tenant granted.

• Identity: organisation id and account id, employment status, verification dates. No password. The work e-mail address stays with the sign-in session only for as long as the session lasts, so that alert e-mails can be switched on without typing it again; it is deleted on sign-out.
• Profile: a display name the person chooses; real name and job title are optional and visible to others only if the person allows it.
• Commute: workplace, starting area (postcode, street without house number or an approximate map point), weekly routine, vehicle and offered seats. An exact home address is never required; others see only an approximate area.
• Collaboration: rides, text messages between matched people, feedback and reports.
• Matching across company boundaries is a setting each person controls (default: on). Your company cannot read it.
• What your company sees: nothing about individual people. There is no employer view. Analyses we make ourselves (routes, times) only look at groups of five people or more. As operator we see key figures, safety reports, restrictions and beta sign-ups. If the company wishes, we send it a monthly summary with totals only (from 5 people up); every view and export of it is logged.
• How you can check this: With a test account, "Download my data" in the app shows everything stored about a person. The privacy policy describes the same categories.

• Every person can delete their account in the app. Open rides are cancelled; profile, routine, messages, blocks, partners, groups, devices, notices and sign-ins are deleted. Past rides and feedback remain without a name.
• Leaving the company: Membership at your company is re-checked every 30 days through the Microsoft sign-in; the person then has to sign in again. Someone who has left the company can no longer sign in. Accounts whose work account could not be confirmed for 12 months are deleted automatically by Comrido (daily run).
• Also deleted automatically: finished sessions together with the e-mail address (daily), requests to be notified after 12 months, safety reports, restrictions, notices and proof of accepted terms 2 years after account deletion. Ride requests expire after 48 hours. Records of whom someone was told about with a new-match alert: after 12 months. “Ask my company” requests: after 12 months. Sessions end after 30 days without use, after 90 days at most; every person can sign out everywhere.
• How you can check this: Create a test account, download its data and then delete it in the app. The periods are in the privacy policy, section on retention.

• Hosting: one server at dogado GmbH in Leipzig. The database cannot be reached from outside. All addresses use HTTPS with HSTS (one year).
• Processors and what they receive: dogado GmbH, Leipzig (hosting). INWX GmbH (domain). Brevo, Sendinblue SAS, France (app e-mails: recipient address and content; under a data processing agreement). Microsoft Ireland (sign-in only). TomTom International B.V., Netherlands (place search and drive times: typed search text, start and destination, position rounded to about 1 km; no IP address, no name). OpenStreetMap Foundation, United Kingdom (map pictures; sees the device's IP address). Open-Meteo, Switzerland (weather for an area rounded to about 10 km). Push services of Google, Apple and Mozilla (only if the person switches push on).
• Statistics exist only on the comrido.com homepage, with our own Umami, without cookies and without reading the device. The app itself has no analytics.
• There is no template yet for a data processing agreement (DPA) between your company and Comrido. If your data protection office wants one, write to us and we will create it.
• How you can check this: Any TLS test (for example SSL Labs) and a look at the response headers of app.comrido.com show the encryption and the protective headers. The processors are also listed in the privacy policy.

• Sessions: The session cookie is HttpOnly and Secure; its value is a random 256-bit value and only its hash is stored in the database. Every request checks the session and the current membership of the company.
• Abuse protection: rate limiting for the whole API (300 requests per minute per session or IP address), stricter for sign-in and forms. Input is checked against a schema on the server; the database limits lengths.
• Browser protection: Content-Security-Policy, embedding of the app only by Teams and Microsoft 365 (frame-ancestors), X-Content-Type-Options, Referrer-Policy and Permissions-Policy. The API serves only JSON and allows no embedding.
• Operator console: its own address, password protection in front and a one-time link sent only to a fixed operator address (15 minutes, single use, 12-hour session). Roles and permissions are separate; actions are recorded in an audit log, and sensitive ones require a reason.
• Logs: without request bodies, cookies or personal data; at most 30 MB per service, then overwritten.
• Quality assurance: automated tests (about 70 test files and browser tests) run during development.
• How you can check this: Browser developer tools show cookie attributes and headers. A security test of your choice against app.comrido.com is welcome if you write to us first.

• No certification: neither ISO 27001 nor SOC 2 nor TISAX.
• There has been no independent penetration test yet.
• Chat messages are stored in plain text in the database (not end-to-end encrypted). Disk encryption at the host is not documented.
• The operator console uses a password and a one-time link, not real multi-factor authentication.
• Messages and past rides of active accounts are not yet deleted automatically (planned: messages after 90 days, rides after 12 months).
• Backup: the server is backed up at night. Retention, encryption and restore tests of the backup are not documented; deleted data may remain in backups until then.
• Someone leaving the company is only noticed at the next check (up to about 30 days), not in real time.
• There is no DPA template, no status page, no fixed incident process and no promised availability.

Please report vulnerabilities confidentially to info@comrido.com. The contact details are also in security.txt.