EU Data Processing
Application data is processed exclusively in European data centers.
Our Infrastructure
Application hosting -- Germany
All application data and the database are stored exclusively in a German data center.
AI gateways -- EU only
AI requests run through EU-bound gateways (France and AWS Frankfurt) and EU direct routes. The EU binding is technically enforced -- calls to non-EU endpoints are blocked.
Our Technical Measures
Legal framework for third-country transfers: GDPR Art. 44–50 (Chapter V — Transfers to third countries).
Frequently asked questions about EU data processing
Where is my data processed?+
Application data (accounts, conversations, configurations, file uploads) is hosted in a German data centre (Hetzner Falkenstein). AI requests are routed via EU-bound gateways in Germany (AWS Frankfurt) and France plus EU direct routes. A full list of locations is provided in the DPA, Annex B.
Who is the controller under data-protection law?+
The customer is the controller within the meaning of Art. 4 No. 7 GDPR. HOVIGuard acts as processor per Art. 28 GDPR. The exact obligations of both parties are regulated in the Data Processing Agreement (DPA).
Which sub-processors are used?+
Hetzner Online GmbH (hosting, DE), Requesty Ltd. (primary gateway, UK under the EU adequacy decision, processing in AWS Frankfurt), OpenAI Ireland Ltd. (EU endpoint), Google Cloud EMEA Ltd. (Vertex AI EU multi-region), Amazon Web Services EMEA SARL (Bedrock Frankfurt), SpaceXAI LLC, formerly xAI (EU region eu-west-1 with zero retention), Eden AI SAS (active AI gateway, FR), Stripe Payments Europe Ltd. (payments, IE), Neue Medien Münnich GmbH (SMTP, DE) and Hetzner Storage Box BX11 (encrypted off-site backups, DE). The full list with safeguards is provided in Annex B of the DPA.
What about third-country transfers?+
Transfers outside the EU are limited to the technically unavoidable minimum. For Stripe and xAI, Standard Contractual Clauses (SCCs) apply together with additional measures (tokenisation, zero retention, IP pseudonymisation). Details are in the Transfer Impact Assessment (available on request).
Which technical measures are in place?+
Transport encryption with TLS 1.3 preferred and TLS 1.2 as the minimum version, fully encrypted backups (BorgBackup, AES-256 with BLAKE2b authentication), AES-256-GCM encrypted storage of credentials, multi-tenant isolation at the database level, and regular security updates. A full list of TOMs (technical and organisational measures) is provided in the DPA, Annex A.