Hetzner Online GmbH, Germany, backups in Finland
Servers, databases and object storage in the Falkenstein and Nuremberg data centres. Database backups in Hetzner Object Storage in Helsinki (Finland), retained for 30 days.
Trust Center
Verifiable, not just claimed.
As of 22 October 2026. The servers are at Hetzner in Germany, and AI comes directly from Mistral AI in France. We don't yet hold our own certifications. All providers are named here. Anything not yet evidenced is not a promise.
The location
The servers are right here.
The applications run at Hetzner in Falkenstein, this website in Nuremberg. What is processed outside Germany is shown in the list below.
Your time zone
–
- Latency
- –
Measured in the browser using the Navigation Timing API. We don't call any service for this and store nothing.
This website
Nuremberg
Hetzner Online GmbH
The website is hosted on a Hetzner server in Nuremberg. Fonts, icons and scripts come from our own domain; we do not use a content delivery network.
Falkenstein data centre
Falkenstein
Hetzner Online GmbH
The new applications, their databases and object storage run in the Hetzner data centre in Falkenstein (Vogtland). The operator is Hetzner Online GmbH, based in Gunzenhausen, Germany.
Backups in Helsinki
Helsinki, Finland
Hetzner Online GmbH
Database backups run continuously and nightly to Hetzner Object Storage in Helsinki (Finland) and are retained for 30 days. File storage is backed up nightly in encrypted form. There is no synchronous replication to a second site.
Physical security
The data centres are operated by Hetzner. According to Hetzner, they are certified to ISO/IEC 27001. The certificate applies to Hetzner, not to EU Suite. We have no physical access to the servers.
Subprocessors
For product data, we only use European providers. The AI models come from Mistral AI in France, connected directly and with no intermediary. Only our business email runs on Microsoft 365, whose parent company is based in the USA; no product data is stored there. Email sending (Lettermint) runs through a provider in the Netherlands, payments through Stripe in Ireland, whose parent company is based in the USA; no content goes there. The full list with purpose and country is below and on its own page. We notify customers of changes 30 days in advance.
Lettermint, Netherlands
Sending of login and invitation emails, for example from EU Chat, EU Notes and EU Recap.
Microsoft 365 (Microsoft Ireland Operations Ltd.), Ireland, parent company in the USA
Business email from eu-suite.de, for example enquiries to hallo@ and datenschutz@. No product data. The parent company is based in the USA and is subject to the CLOUD Act.
Mistral AI SAS, France
AI models, connected directly with no intermediary: in EU Recap, transcription (Voxtral) as well as summary, decisions and tasks; in EU Notes, the AI features.
Meeting BaaS, France
EU Recap: recording bot that joins Zoom, Microsoft Teams and Google Meet as a participant. We haven't yet confirmed where the bot servers run.
Stripe Payments Europe, Ltd., Ireland, parent company in the USA
Payment processing for paid licences and refunds, for example after a withdrawal. Based in Dublin. Stripe may transfer data to Stripe, Inc. in the USA, which is certified under the EU-US Data Privacy Framework.
Contracts
The data processing agreement under Art. 28 GDPR is intended to be part of every paid subscription and to apply from the first paid licence. A reviewed version isn't available to download yet; we'll send the current version on request. The Free tier comes without a DPA.
DPA under Art. 28 GDPR
The agreement sets out the purpose of processing, data categories, deletion periods, the right to issue instructions, and the list of subprocessors. It takes effect automatically when the contract is formed. We provide a signed version on request within two working days.
Transfers to the USA
Product data does not leave the EU: transcription and AI features run at Mistral AI in France. The only exception on our list is business email via Microsoft 365 (parent company in the USA), meaning what you write to us by email. A basis under Art. 44 et seq. GDPR applies to this; we'll tell you the current status of the documentation on request.
Right to issue instructions
Customers can instruct EU Suite at any time to delete, block or export data. Instructions are confirmed within 72 hours and carried out within seven working days. For complex deletion requests, an extended window of 30 days applies, documented in the DPA.
Termination and data return
After termination, all data remains available for export for 30 days. Full export is available at any time and at no extra cost, including on the free tier. After 30 days, all data is deleted; a written deletion confirmation is issued on request.
Certifications
We state the status of our certifications as it actually is, not as it's meant to look. A young company that lists every certificate as "granted" while the audits are still running isn't a sign of trust. That's not us.
Penetration test, internal
We currently test the applications ourselves. An external penetration test is planned but not yet commissioned. We therefore can't provide an external audit report.
ISO/IEC 27001, goal
EU Suite is not certified to ISO/IEC 27001, and no audit has been commissioned. The standard is a goal. According to Hetzner, the data centres where our servers are located are certified.
BSI C5, goal
A C5 attestation (the BSI's Cloud Computing Compliance Criteria Catalogue) is a goal; no audit process is under way. Until it's granted, we can't provide any C5 evidence.
GDPR compliance self-declaration
Our technical and organisational measures are set out in Annex 1 of the DPA (version of 27 October 2026) and are intended to be updated annually. They don't replace an external audit.
Security architecture
EU Suite is built as multi-tenant SaaS, with customer data strictly separated at the database level. No user can access another customer's data, not even through a misconfiguration of their own organisation.
Tenant separation
Every organisation gets its own database schema instance. Requests are checked against the relevant organisation ID at the application level, in addition to the database level. A configuration error in one organisation cannot expose another organisation's data.
Encryption
Connections to the applications are encrypted via HTTPS (TLS). File storage backups are encrypted before they leave the server. We do not commit to encrypting the server disks themselves.
Access by EU Suite staff
No EU Suite employee has routine access to production data. Access for support and debugging requires a written request, the customer's consent, and a four-eyes principle. All access is logged and can be viewed by the customer on request.
Vulnerability management
There's no bug bounty programme. We accept security reports at security@eu-suite.de and fix them in order of severity first.
AI and your data
EU Suite currently uses AI in EU Recap and EU Notes. EU Assist is in a closed alpha. Here we describe where the data goes.
Which providers run the models
We don't operate our own AI hardware. All AI models come from Mistral AI in France, connected directly with no intermediary: EU Recap transcribes with Voxtral and summarises with Mistral, and the AI features in EU Notes use models from Mistral. We don't use providers outside the EU for AI.
No training on customer data
EU Suite doesn't train any models on its customers' content. Meeting transcripts, notes and documents are used for the function they were uploaded for. What the AI providers may do with requests is governed by their own terms.
Opt-in for AI features
EU Recap and EU Assist are active by default, but can be disabled by organisation administrators, either for individual users or the whole organisation. When EU Recap is disabled, no audio is processed and no transcription is created.
Transparency over AI output
Summaries and minutes created by EU Recap are labelled as AI-generated. The version requiring approval only takes effect once a person has confirmed the minutes. We label AI output consistently, even when it slows the workflow down.
Data export and portability
Your data belongs to you. Full export is available at any time and at no extra cost. We don't lock in data, and we don't make switching to another provider any harder than it needs to be.
Full export available at any time
Every organisation can trigger a complete export of all data under Settings → Data → Export. The export includes: notes as Markdown and PDF, meetings as transcript and summary, tasks as CSV and JSON, time entries as CSV, personnel files as an encrypted ZIP. The export is ready within 24 hours.
Open formats
All export formats are open and machine-readable. No proprietary format that only EU Suite can read. Notes are Markdown, tables are CSV, structured data is JSON. We follow the principle: whatever can be imported must be exportable too.
API access
Customers on the Business and Enterprise plans get access to the REST API. All data accessible through the interface is also retrievable via the API. Rate limits are documented and are no more restrictive than for internal use.
After termination
After termination, the export remains available for 30 days. After that, all data is irrevocably deleted: no restoration, no residual data in backups once the deletion period has passed. We provide a written deletion confirmation on request.
Evidence
What we have, and what we don't yet.
A young provider doesn't hold every certificate. Stating that openly is more credible than claiming a level of maturity we haven't reached yet. This table changes as soon as something changes.
Penetration test, external
We currently test internally. There's no external audit report yet.
ISO/IEC 27001
EU Suite is not certified. According to Hetzner, the data centres where our servers are located are certified.
BSI C5
A C5 attestation is a goal. No audit process is under way; until it's granted, no C5 evidence can be provided.
GDPR self-declaration (TOMs)
Self-declaration on technical and organisational measures, published as Annex 1 to the DPA. Doesn't replace external certification.
WCAG 2.2 AA (accessibility)
Internal testing with axe DevTools and manual keyboard navigation. An external audit by a specialist body is planned for 2027.
Annex to the DPA
Technical and organisational measures.
The eight control areas under Art. 32 GDPR. The same list is attached to the DPA as an annex.
01
Entry control
- Servers in data centres operated by Hetzner Online GmbH in Falkenstein and Nuremberg, certified to ISO/IEC 27001 according to Hetzner
- Entry control, video surveillance and security staff at the data centre are handled by Hetzner
- No physical access to server hardware by EU Suite staff
- Visitor log for every physical entry
02
Access control
- Multi-factor authentication (MFA) for all internal systems and production access
- Password manager with organisation-wide enforced password policies (min. 16 characters, no reuse)
- Single sign-on (SSO) for all internal services with a central identity provider
- Automatic session timeouts after 30 minutes of inactivity
- Hardware security keys (FIDO2) for higher-risk production access
03
Authorisation control
- Role-based access control (RBAC); every employee only has the permissions needed for their role
- Four-eyes principle for access to customer data in production
- Complete logging of all access to production databases
- Tenant separation at the database schema level, no shared storage between organisations
- Regular review and revocation of access rights no longer needed (quarterly)
04
Transmission control
- Encrypted connections to the applications over HTTPS (TLS)
- Transfers outside the EU only to the providers on the subprocessor list
- File storage backups encrypted before they leave the server
05
Input control
- Complete audit logs for all data changes in production systems
- Immutable logs (append-only) for security-relevant events
- Automatic detection and alerting for anomalous access patterns
- Regular integrity checks of database backups
06
Processor control
- DPAs under Art. 28 GDPR with the subprocessors; we'll state the status for each provider on request
- Subprocessor list publicly viewable, changes communicated with 30 days' notice
- Regular review of subprocessors for data protection compliance (at least annually)
- The customer's right to issue instructions is enshrined in the contract; instructions are carried out within seven working days
07
Availability control
- Continuous and nightly database backups in Hetzner Object Storage in Helsinki (Finland), retained for 30 days
- No synchronous replication to a second location
- Monitoring of application uptime
- Incident response plan with defined response times (detection and escalation within two hours)
08
Separation control
- Strict tenant separation: every organisation gets its own database schema
- Test data is completely separate from production data; no use of real data in development environments
- AI models process customer data in isolation, no cross-tenant learning, no shared context
- Separate network segments for production, staging and development
What we don't do
Seven statements you can verify.
- We don't set cookies that require consent.
- We don't load fonts, scripts or videos from US servers.
- We don't train models on your data.
- We name every provider outside the EU.
- We don't take screenshots and don't track activity.
- We don't sell usage data.
- We don't lock in your data; full export is always available.
For data protection officers
The questions you'll ask.
Schrems II, the CLOUD Act, the right to issue instructions, notification deadlines. Answered factually. This doesn't replace legal advice, but it answers the initial screening.
How is the Schrems II third-country transfer handled at EU Suite?
For product data, the question does not arise: the applications run with Hetzner Online in Germany, and their backups are stored with Hetzner in Helsinki (Finland), so within the EU. We don't use a CDN outside the EU, and transcription and AI features run at Mistral AI in France. Only our business email runs on Microsoft 365, whose parent company is based in the USA. A basis under Art. 44 et seq. GDPR applies to this transfer; we'll state the status on request.
Does the CLOUD Act apply to EU Suite or its subprocessors?
The CLOUD Act allows US authorities to demand data from US companies, even if it's stored on servers outside the USA. EU Suite is not a US company. Our hosting provider, Hetzner Online, is a German company with no US parent. Among our subprocessors, only Microsoft (business email, no product data) belongs to a US group; the CLOUD Act applies to the emails held there. Product data is held with providers in the EU.
How is data processing under Art. 28 GDPR arranged?
The DPA under Art. 28 GDPR is part of every paid subscription and applies from the first paid licence. The Free tier comes without a DPA. It sets out the purpose of processing, data categories, deletion periods, the right to issue instructions, and the subprocessor list. A reviewed version isn't available to download yet; we'll send the current version on request.
What does the deletion concept look like, and what retention periods apply?
After termination, all data remains available for export for 30 days. After that, the data is deleted from the production database. It remains in backups until the relevant backup expires under the product's rotation schedule; we'll state the period for each product on request. For customers with statutory retention obligations (e.g. law firms, practices), we recommend exporting data completely before termination and keeping it locally or in an archived system. EU Suite is not an archiving system.
How are data subject rights and access requests handled?
Access requests under Art. 15 GDPR can be answered by customers themselves from within EU Suite: under Settings → Privacy, all data stored about a person is available in structured format. For requests that can't be self-served, datenschutz@eu-suite.de is available. We respond within the statutory period of one month.
Can I instruct EU Suite to delete or block data?
Yes. The right to issue instructions under Art. 28(3) GDPR is enshrined in the DPA. Send instructions in writing to datenschutz@eu-suite.de. We confirm the instruction within 72 hours and carry it out within seven working days. Complex deletion requests (e.g. deletion across all backup tiers) can take up to 30 days; this period is documented in the DPA.
How are changes of subprocessor communicated?
We announce changes to the subprocessor list 30 days in advance by email to the organisation administrator's registered address. If you object to the change, you can cancel the subscription with no penalty as of the date of the change. The current state of the subprocessor list can be viewed on this page at any time.
What happens in the event of a data breach, and how is the 72-hour deadline handled?
EU Suite is obliged under Art. 33 GDPR to report data breaches to the competent supervisory authority within 72 hours. We inform affected customers immediately and without undue delay. Our data breach response times are documented in the incident response plan: detection and escalation within two hours, initial status report to customers within eight hours, full analysis within 72 hours.
Does EU Suite train models on customer data?
No. EU Suite doesn't train any models on its customers' content. Meeting transcripts, notes and documents are used exclusively for the function they were created for: summarising, task extraction or search within your own organisation. We don't operate our own models or our own AI hardware. Which providers run the models is covered in the AI and your data section.
What's the availability, and what's the exit strategy?
We don't promise any availability figure today. It will only be set out in the contract. A public status page is under construction and doesn't yet show measurements. Full export is available at any time at no extra cost, so you can switch to another provider whenever you want. If we were to cease operations, all customers would be informed six months in advance and would have access to export until the last day.
How is employee data protection handled under § 26 BDSG?
EU Suite doesn't process employee data without explicit configuration by the employer as controller. EU Track only records time data when employees actively book it: no automatic activity measurement, no screenshot feature, no keystroke logging. For using EU HR and EU Track, we recommend concluding a works agreement under § 87(1) no. 6 BetrVG. A template works agreement is in preparation.
Can government or law enforcement authorities access our data?
EU Suite is obliged to comply with lawful requests from German and European authorities, like any company in Germany. EU Suite itself is not subject to the CLOUD Act. For business email held with Microsoft, however, US authorities can approach the provider directly, without our knowledge; no product data is stored there. We inform affected customers of official requests wherever we are legally able to, a notification duty we've set out in the DPA.
Your question isn't here? Write todatenschutz@eu-suite.de
A reply within two working days, no sales call.
