SiemensHow this portal handles your dataSign in

This is a factual description of how the software works, written from the source code. It is not a legal notice and it is not the program's privacy policy — that documentation has not been issued yet, and nothing here states or implies compliance with any law. Where something needs a decision or a person, ask your program administrator.

Companies involved

Running this portal means other companies handle some of the data. This is the complete list as the code has it — not a general policy about which vendors might be used, but which ones this system actually talks to.

Three of them are optional and switch on only when they are configured. The status column reports what is switched on in the deployment you are reading this from, checked as the page loads rather than written down in advance.

  • Vercel

    Always in use

    Runs the application. Every page you open and every action you take passes through it.

    The deployment target — vercel.json, and the platform the app is built for.

  • The Postgres database (Supabase)

    Always in use

    Stores every record described on the “Your data” page. This is the system's single store of record.

    The app connects to Postgres through Drizzle. That it is Supabase specifically comes from the project's own configuration, not from the code.

  • Vercel Blob

    Not configured here

    Holds the contents of files you upload. The storage path contains the uploading account's id. Links are unguessable but are served without a further sign-in check.

    src/lib/attachments.ts picks this store only when a storage token is configured; without one, file contents are kept inside the database instead.

  • Microsoft Entra ID

    In use here

    Signs you in, and supplies your work email address, display name and tenant identifier. The portal never holds your corporate password.

    src/auth.ts registers this sign-in provider only when its settings are present.

  • Resend

    Not configured here

    Sends email — the recipient address and the full message text. It is the only delivery provider in the code.

    src/lib/email/provider.ts. With no API key configured, messages are still composed and logged, but nothing leaves the system.

  • YouTube and Vimeo

    Always in use

    Nothing is sent to them by the portal. But opening a learning resource that has an embedded video makes your own browser contact that host, which is how any embedded video works.

    src/lib/embed-hosts.ts — these two are the only outside origins this app may place in a frame, and the security headers enforce it.

What this list does not tell you

  • Where the servers physically are. That depends on settings held in the hosting accounts, which this code cannot read. Naming a country here would be a guess.
  • The paperwork behind each company — whether a processing agreement is signed, or whether any of them holds a certification. The application can see that a service is wired in. It cannot see a contract.
  • Anyone further down the chain. These companies use suppliers of their own; that is between them and their own published information.

If you need any of those answers, ask your program administrator. They come from the organisation, not from this software.