FAQ

security

Where is my data stored?

On servers we operate in Frankfurt, Germany (EU). Databases, uploaded files and configuration stay in that environment. Encrypted backups are additionally stored with Backblaze B2; they leave the server only in encrypted form.

Do you take backups, and have they been tested?

Yes. Databases, configuration and application data are backed up every night, encrypted with AES-256 (restic) before upload, and stored with a second provider. Each run includes an automated restore test, so an unrestorable backup counts as a failed backup.

Who on your side can see my data?

Production access is limited to the founder, over key-only SSH and a private VPN. Customer databases are not opened for routine work; when troubleshooting requires it, the work is scoped to the specific issue.

Are you KVKK compliant?

We act as data processor for customer data and process it only on documented instructions. A data processing agreement can be signed before onboarding, subprocessors are listed on this page, and access, backup and incident procedures are documented. We do not claim a certification we do not hold.

What happens if the service goes down?

Every public service is probed continuously and the operator is alerted within minutes. Restores from the previous night's backup are tested every night, so recovery does not depend on an untried procedure.

Can you delete my data?

Yes. On request, data is removed from production within 30 days and ages out of the encrypted backups within the retention window. You receive written confirmation when production deletion is complete.

Do you have a penetration test or a certificate?

No ISO 27001, SOC 2 or third-party penetration test is available today, and this page does not pretend otherwise. What is implemented is listed under Controls, as concrete measures rather than marketing claims.