Everything below is either running today or listed as missing. No badges we have not earned, no promises we cannot keep.
Last reviewed: 2026-10-12
All compute and all data run in EU datacenters.
Being in the EU is not the same as being out of reach of the US CLOUD Act: a US-parent company can be compelled to hand over data even when the server sits in Europe. We say which of our providers are in that situation instead of letting you find out during a DPA review.
1 of the 3 infrastructure providers has a US parent company (Backblaze), so the US CLOUD Act reaches it even though the servers are in Europe.
Connection strings, environment variables, provider tokens and SMTP credentials are encrypted at rest with envelope encryption (a random data key per secret, wrapped by a dedicated master key — the KMS model). The master key is separate from the session secret and can be rotated without downtime: the previous key keeps decrypting during the rotation.
Database backups, object storage and our own control plane replicate to a separate provider (Backblaze B2) with Object Lock: every copy is retained for 30 days in compliance mode (since October 2026): nobody can delete or shorten that retention — not our servers, not our own administrator key, not even the storage provider. So neither credentials stolen from our infrastructure nor a mistake on our side can destroy the copies of the last 30 days — at most hide them, which our daily comparison of both sides would flag the same day.
Compute is not one pool. Customer apps, databases and managed WordPress run on separate fleets, and a workload never lands outside its own — it is a security boundary, not a capacity one. WordPress containers additionally run under gVisor (a userspace kernel), because they execute third-party PHP plugins. Apps can opt into gVisor too.
Every security or configuration change — members and roles, API tokens, resource creation and deletion, deploys, domains, DNS, firewall, spending — is recorded with who did it (person or agent), from which IP and when, and can be exported to CSV.
API tokens are stored hashed, carry per-action scopes, an expiry and a hard cost cap, and can be scoped to a single project. For disaster recovery, the control plane backup and the environment file are encrypted with a public key: the server can write them but cannot read them back — only the founder’s private key can. That breaks the circular dependency where losing the server means losing the keys to your own backups.
The third parties that process data on our behalf. This list is generated from the code: adding a cloud provider without disclosing it breaks our build.
| Provider | What it does | Where it processes | Parent company |
|---|---|---|---|
| Hetzner Online GmbHEssential | Servers for apps, databases and the edge | Nuremberg and Falkenstein (Germany) | 🇪🇺 UE |
| Contabo GmbHEssential | Servers for the control plane, the object storage cluster and our CI | Germany (EU) | 🇪🇺 UE |
| Backblaze, Inc.Essential | Offsite, immutable copies of every backup (databases, buckets and the control plane) | Amsterdam (Netherlands, region eu-central-003) | 🇺🇸 US |
| Cloudflare, Inc.Essential | DNS, CDN, DDoS protection and bot challenge | Global network (cached HTML may be served from points of presence outside the EU) | 🇺🇸 US |
| Stripe, Inc.Optional | Payments | EU / US | 🇺🇸 US |
| Resend, Inc.Optional | Transactional email we send (sign-in codes, alerts) | US | 🇺🇸 US |
| Google Ireland Ltd.Optional | Sign in with Google (optional) | EU / US | 🇺🇸 US |
| GitHub, Inc. (Microsoft)Optional | Deploying from your repository (optional) and our CI | US | 🇺🇸 US |
Stated plainly, because you will find out anyway — better here than in production.