Information Security

Reporting a security concern

If you think you've found a security vulnerability in Citavi, please contact Lumivero through the Lumivero contact page. We'll get in touch.

How we keep Citavi safe

Citavi is developed by Lumivero. Lumivero maintains an information security program and is SOC 2 Type II certified. You can review Lumivero's security certifications and compliance attestations at the Lumivero Trust Center. For terms of use, privacy, and data-protection information, see Lumivero's legal information.

DBServer 

Connection

Citavi uses the .NET default libraries (System.Data.SqlClient) to connect to the SQL server. The entire communication between Citavi and the database server occurs on this basis and according to the widely used SQL server protocols established by Microsoft.

DBServer Manager

DBServer Manager is not a server software program and does not communicate with Citavi. DBServer Manager is front end and is used to send SQL statements to a selected SQL Server. You can think of DBServer Manager as a "Management Studio light specifically for Citavi". Since DBServer Manager is not a server program, it is not critical from a security standpoint.

Project and data security

Standard SQL Server processes are used for security at the database and project level.

At the SQL Server level, each project is a schema. Each schema has three roles: Project leaders, Authors, and Readers. Authors have the schema rights Insert/Update/Delete. Readers only have Select rights. (In addition to Author rights, Project leaders also have the right to change roles.)

If a user is given author rights in DBServer Manager the user will be added to the corresponding project schema with the "Author" role via SQL. This architecture means that even if a user accesses the SQL Server database with a client other than Citavi, he or she can only see the data that he or she would be able to see with Citavi.