Skip to content
BuildStackHQHosting

Trust

Where your data is, and who else can touch it.

One region, one door out, one list of companies involved. This page is the short version. The documents behind it are drafts a lawyer has not finished reading, and this page says so wherever that matters.

  • eu-central-1, Frankfurt
  • no third-country transfer
  • four companies on the list
  • no certification claimed

Residency

One region is the product, and it is also the single point of failure.

The mechanisms are the same four the home page describes. They are repeated here because this is the page a security reviewer is sent, and it should not depend on them having read the home page first.

  • It is created in one region

    Compute, databases, backups, logs, traces and build artifacts are created in eu-central-1 and nowhere else. The region is written into every infrastructure provider block with no variable that could change it.

  • It leaves through one door

    A container starts with no route out. Every hostname resolves to the egress gateway, which reads the name out of the TLS handshake and matches it against the list before forwarding a byte. An IP literal, a port other than 443 and any unlisted name are closed at the network.

  • It is encrypted with keys held here

    Data at rest is encrypted with keys in the same region. The object store refuses any write that is not encrypted and that does not name a key, and refuses every request that is not over TLS.

  • What it did is written down

    Every model call and every tool call is a step in the run trace, recorded from the traffic rather than from your logging. A refused connection is a step too, so you can see what was blocked as well as what got through.

The diagram of the boundary, and what happens when a run touches it, is on the home page.

Who else is involved

The companies that can touch anything, and what each one touches.

This list is the whole list. It is rendered from the same file as the register in our data processing documents, so the two cannot say different things.

The register is quoted exactly as our data processing documents state it, and those documents still use the platform's earlier name, Keel.

  • Amazon Web Services EMEA SARL

    in use today
    Services
    EC2 and EBS, S3, KMS, Secrets Manager, Route 53, Systems Manager Session Manager, CloudWatch Logs and Metrics, Data Lifecycle Manager, Elastic Container Registry
    Processes
    Everything the platform stores: the platform database on the instance volume, run and trace payload objects, static site files, nightly database dumps, generated platform credentials, DNS records for platform hostnames, container logs and host metrics, and daily machine images of the whole host.
    Where
    eu-central-1, Frankfurt
    Why
    The infrastructure Keel runs on. One region, pinned in every Terraform provider block, with no variable that could change it.

  • Internet Security Research Group (Let's Encrypt)

    in use today
    Services
    ACME certificate issuance
    Processes
    The hostnames Keel terminates TLS for: the platform hostnames, the wildcard for service and site hostnames, and every custom domain a customer points at the platform. Hostnames only, never request or response content.
    Where
    United States. Certificates and the hostnames inside them are public by design and are published to Certificate Transparency logs.
    Why
    So a customer never uploads a private key. Caddy obtains a certificate for a custom domain on its first request, and only for a hostname the relay would already route.

  • GitHub, Inc. (Microsoft)

    in use today
    Services
    Source hosting and continuous integration for Keel's own code
    Processes
    Keel's source code and, during a deploy, short-lived OIDC credentials. No customer data. The git build path, which would send a customer's repository through a build, is not configured on the host that is live today.
    Where
    United States, with build runners wherever GitHub places them.
    Why
    Where Keel itself is developed, reviewed and deployed from.
    Note
    Listed for completeness. GitHub processes Keel's code, not customer content, on the deployment that is live today.

  • Stripe Payments Europe, Limited

    in use when the deployment enables it
    Services
    Subscription billing, Checkout, the Customer Portal, Billing Meters and invoicing
    Processes
    Billing contact details, company name, billing address, EU VAT identifier and tax status as collected in Checkout, the payment instrument, and metered usage quantities keyed by an opaque Stripe customer identifier. Never a run payload, a trace or a log line.
    Where
    Ireland, under Stripe's own terms and its own subprocessor list.
    Why
    Taking payment and issuing invoices, including the reverse charge through Stripe Tax.
    Note
    Active only when the deployment runs with BILLING=stripe. Enterprise is invoiced by hand.

  • Amazon Web Services EMEA SARL (Simple Email Service)

    not in use yet
    Services
    Transactional email for organization invitations
    Processes
    The invited person's email address and the invitation text.
    Where
    eu-central-1, Frankfurt
    Why
    Telling an invited colleague that they have been added to an organization.
    Note
    The default mailer is INVITATION_MAILER=log, which sends nothing. SES is used only once that variable is switched.

We give thirty days' notice by email, to every customer with a signed data processing agreement, before a new company on this list starts processing anything. Updating this page is not notice and we do not treat it as notice.

The Fargate deployment described in infra/terraform/modules is built but not the deployment that is live. When it is used it adds ECS Fargate, RDS, SQS, EventBridge Scheduler, EFS, CodeBuild, ACM and Elastic Container Registry for customer images, all from the same provider in the same region.

Jurisdiction and access requests

Whose law the infrastructure sits under, and what happens if a government asks.

The EU Data Act asks a hosting provider to publish this, so here it is rather than in a PDF you have to request.

Jurisdiction of the infrastructure
Everything runs in Frankfurt, Germany, and is subject to German and Union law. Our infrastructure provider contracts through a Luxembourg entity, which belongs to a group whose ultimate parent is in the United States.
Transfers
There are none for your data. We process in the EU and so does every company on the list above that touches your data, so there is no third-country transfer to put a safeguard around.
If an authority outside the EU asks
We answer only where Article 48 GDPR permits it, that is, under an international agreement in force. We tell you before we respond unless we are legally forbidden to, we challenge a request that is overbroad or unlawful, we disclose the minimum, and we do not act against your written instructions.
Requests received to date
None. We publish the number here and update it when it changes.

Which rules reach us, and which do not.

  • GDPR

    Applies

    We are your processor for what you deploy, and our own controller for your account, billing and support records. The agreement, the processing record and the measures are drafted.

  • EU Data Act, switching

    Applies

    In full, since September 2025, with no exemption for a company our size. Thirty days to switch, at least thirty more to retrieve, and we charge nothing for either.

  • NIS2

    Not in scope

    Cloud providers are in the Directive's first annex, but it reaches only entities that are at least medium-sized, roughly fifty staff or ten million euro. We are far below that. If we crossed it we would be an important entity, not an essential one.

  • DORA

    Not directly regulated

    Its obligations bind financial firms, who pass requirements down by contract. A provider is regulated directly only once it is designated critical, which has a ten percent market relevance threshold. Talk to us early if you are a financial firm, because some of what DORA asks for is beyond what we can honestly promise today.

  • EU AI Act

    Not in scope

    We are not the provider, deployer, importer or distributor of your AI system. We rent you compute and record what it did. If you build a high-risk system on us, the Act lets you require a written agreement about the information and access you need, and we will sign one.

What we do not claim

The parts a certification would have papered over.

  • We hold no SOC 2 report and no ISO 27001 certificate, and we have never had an external audit or a penetration test. There is no report to send you.

  • The platform runs on one host in one availability zone today. There is no failover and no second region, and a hardware failure is an outage until we launch the most recent machine image by hand.

  • We take a database dump every night and a machine image every day, and we have never rehearsed a restore on a schedule. We publish no recovery time objective because we have not measured one.

  • We have a program that tries to break out of the sandbox in every way the design forbids. It runs nightly against the deployment we have built for scale, and not against the one that is live.

  • Your plan states a trace retention period and we now enforce it hourly: the request and response bodies of a step are deleted once they pass it, and the step keeps its timing, status and token counts. What we still do not expire is the rest of what a run leaves behind, its output archive, its checkpoints and its log chunks, so assume those are still there.

  • There is no export-everything button and no delete-my-organization button. Both are things we do by hand, for free, on request, and you should know that before you sign rather than after.

  • A host you add to your own allowlist is outside the residency guarantee. We say so where you add it, and every connection to one is still a step in the trace.

Documents

Six documents, on request, in draft.

They are written and they are honest, and a lawyer has not finished reading them. We will send you any of them today marked as a draft rather than make you wait, because you can judge a draft and you cannot judge a promise of one.

  1. 01

    Data processing agreement

    Every element Article 28(3) requires, the subprocessor terms, the audit and assistance terms, deletion on termination, and an annex of the measures with the file that implements each one.

  2. 02

    Technical and organisational measures

    The long version of this page, by Article 32 heading, written for the engineer on your side. It ends with a numbered list of every gap.

  3. 03

    Subprocessor register

    The list above, with the jurisdiction statement and the commitment to announce a change before it takes effect.

  4. 04

    Record of processing activities

    Our Article 30(2) record. You get the extract for your organization, never a version that names another customer.

  5. 05

    Breach procedure

    The runbook: the clock, who does what, how we work out which customers are affected from the audit log and the traces, and the notification templates.

  6. 06

    Export and exit

    Every format and endpoint you can pull your data through, the Data Act timeline, and the four things that are not self-service yet.

A person

Found something, or need something signed?

Security reports and compliance questions both go to a person, not a form. Tell us what you did, what you saw and the time in UTC. A run id and an organization id are enough for us to find it, so please do not send us anyone's personal data.

Report a security problemAsk for the documents

security@buildstackhq.com · info@buildstackhq.com