Everything below is either running today or listed as missing. No badges we have not earned, no promises we cannot keep.
Last reviewed: 2026-07-26
All compute and all data run in EU datacenters.
Being in the EU is not the same as being out of reach of the US CLOUD Act: a US-parent company can be compelled to hand over data even when the server sits in Europe. We say which of our providers are in that situation instead of letting you find out during a DPA review.
Toda la infraestructura está en centros de datos de la UE. 2 de los 3 proveedores de cómputo tienen matriz en EE. UU. (DigitalOcean, Oracle), así que el US CLOUD Act les alcanza aunque el servidor esté en Europa.
Connection strings, environment variables, provider tokens and SMTP credentials are encrypted at rest with envelope encryption (a random data key per secret, wrapped by a dedicated master key — the KMS model). The master key is separate from the session secret and can be rotated without downtime: the previous key keeps decrypting during the rotation.
Database backups and object storage replicate to an offsite node with Object Lock (30-day governance retention) plus versioning. The writer there is a least-privilege user with no delete and no bypass permission, so credentials stolen from our own control plane cannot destroy the copies. Verified end to end: deletion and bypass are both denied.
Compute is not one pool. Customer apps, databases and managed WordPress run on separate fleets, and a workload never lands outside its own — it is a security boundary, not a capacity one. WordPress containers additionally run under gVisor (a userspace kernel), because they execute third-party PHP plugins. Apps can opt into gVisor too.
Every security or configuration change — members and roles, API tokens, resource creation and deletion, deploys, domains, DNS, firewall, spending — is recorded with who did it (person or agent), from which IP and when, and can be exported to CSV.
API tokens are stored hashed, carry per-action scopes, an expiry and a hard cost cap, and can be scoped to a single project. For disaster recovery, the control plane backup and the environment file are encrypted with a public key: the server can write them but cannot read them back — only the founder’s private key can. That breaks the circular dependency where losing the server means losing the keys to your own backups.
The third parties that process data on our behalf. This list is generated from the code: adding a cloud provider without disclosing it breaks our build.
| Provider | What it does | Where it processes | Parent company |
|---|---|---|---|
| Hetzner Online GmbHEssential | Servers for apps, databases and the edge | Núremberg y Fráncfort (Alemania) | 🇪🇺 UE |
| DigitalOcean LLCEssential | Servers, block volumes and the offsite backup node | Fráncfort y Ámsterdam (UE) | 🇺🇸 US |
| Oracle Cloud (OCI)Essential | The node that runs the control plane | Madrid (España) | 🇺🇸 US |
| Cloudflare, Inc.Essential | DNS, CDN, DDoS protection and bot challenge | Red global (el HTML cacheado puede servirse desde PoPs fuera de la UE) | 🇺🇸 US |
| Stripe, Inc.Optional | Payments and subscriptions | UE / EE. UU. | 🇺🇸 US |
| Resend, Inc.Optional | Transactional email we send (sign-in codes, alerts) | EE. UU. | 🇺🇸 US |
| Google Ireland Ltd. (inicio de sesión con Google)Optional | Sign in with Google (optional) | UE / EE. UU. | 🇺🇸 US |
| GitHub, Inc. (Microsoft)Optional | Deploying from your repository (optional) and our CI | EE. UU. | 🇺🇸 US |
Stated plainly, because you will find out anyway — better here than in production.