Data protection and security: hosting, providers, transfers

The questions a buyer in Germany or Finland asks before signing, answered on one page.

What this page is. It describes our hosting, providers, transfers and security. It is not a privacy notice.

• Your data and your rights: what we collect about you, why, and your rights over it are set out in our Privacy Policy and KVKK Information Notice (/privacy-policy).
• Client data: for data we process on a client's behalf, the governing contract is the Data Processing Agreement (/legal/dpa).
• Conflicts: nothing on this page says more than the DPA. If this page and the DPA differ, the DPA prevails.

The short version

• Hosting: this site, the Reactll Connect data, the HQ and the Reactll app data are hosted in Frankfurt, Germany. Client systems run on their own separate servers; we tell you their region on request.
• Access:
  • Our registered office and most of our team are in Istanbul, and our managing director works from the Netherlands.
  • Access from Türkiye to client data stored in the EU is a transfer outside the EEA. We cover it with the EU standard contractual clauses (SCCs).
  • No one accesses client or CRM personal data from the United States.
• Providers: some of our providers are US companies. We name them below.
• No IP addresses in our analytics: our own analytics stores no IP address, and a scheduled job deletes its data automatically after 24 months.

Where the data is

Our own server.

• Location: our production server is a virtual server at DigitalOcean in Frankfurt.

• What it holds:

  • the HQ, Reactll Connect and app data;
  • our own projects, and our development and test work;
  • the database, sessions, queues and uploaded files.

  We do not use a separate third-party queue or object store.

• Administration: the server is administered through RunCloud, a server management panel with administrative access to it. The data stays on the server.

• Who can access it: only our core team.

Client sites.

• Hosted by us: client systems run on their own separate servers, not on ours. We tell you the region of a client's server on request.
• Hosted elsewhere: when a client's infrastructure is elsewhere, we work in it rather than move their data to ours, and the engagement says so in writing.

Transfers outside the EEA: the Türkiye question

The European Commission has not adopted an adequacy decision for Türkiye. Client data stays in Frankfurt, but people in Istanbul access it to do the work. That access is a transfer, and it needs a legal basis.

For data we process for clients, the DPA incorporates the EU SCCs:

• Module Two applies where you are the controller and we are your processor.
• Module Three applies where you are a processor and we are your sub-processor.
• For UK data, the UK International Data Transfer Addendum applies.
• For Swiss data, the SCCs apply with the Swiss adaptations.

For data we collect directly from you (for example when you write to us), the GDPR applies to us directly, and our Privacy Policy lists the countries the data goes to.

Access controls: access to client data is limited to the people who need it for the work, and it is removed when the engagement ends.

Under Turkish law. Storing data in Frankfurt and using the providers abroad listed below are transfers abroad under Art. 9 of the Turkish Personal Data Protection Law (KVKK). The countries and purposes are set out in the table below and in our Privacy Policy.

Sub-processors and providers

These are the providers who can access personal data from this website, the Reactll app or the systems we run for clients, and the reason for each. The table is the list in Annex III of our DPA. We add a new sub-processor at least 30 days before it starts.

Who is subject to US law. DigitalOcean, Cloudflare, Resend, Google, Anthropic, OpenAI, Expo and Apple are US companies, and Apify may process on US cloud infrastructure. They remain subject to US law even where the data is processed in the EU.

Our own analytics.

• We never store your IP address.
• To count a visit, we combine the address with your browser's identifier and with a random value that is thrown away every day, and turn the result into a hash.
• After that day, we cannot tell which address made which visit.
• The country comes from Cloudflare's network headers.
• Only if you accept cookies does your browser keep a random identifier that lets us see a return visit.

How long we keep things

What we do about security

• Encryption in transit: traffic is TLS-only, and the site is sent with HSTS.
• Backups: we take a verified database backup before every deployment, and delete backups after 30 days at the latest.
• Availability checks: we check the availability of the systems we operate every five minutes. Results for the services we list publicly are at /status.
• Server access: client systems run on their own separate servers. Our own server (our projects, development and test work, Reactll Connect data) is accessed only by our core team, and access is removed when someone leaves.
• Breach notice to clients: if a personal data breach affects a client's data, we tell the client within 48 hours of becoming aware of it (DPA section 9).

We are not certified against ISO 27001 or SOC 2. We would rather say so here than in a procurement call. If your process needs a certificate, tell us early, and we will tell you honestly whether it is worth either side's time. If you are subject to NIS2, a shorter incident-notification clause can be agreed separately from the DPA.

Found a vulnerability?

Write to [email protected].

• We answer within two working days.
• We will not threaten you.
• We will credit you if you want the credit.

The machine-readable version is at /security.txt.

Need the paperwork?

Our Data Processing Agreement (/legal/dpa) is public, in English and Turkish, and lists every sub-processor that can access client data. The EU SCCs are incorporated into it; on request we send you a copy of the clauses as they apply between us.

Company details and the registry entry are in the Imprint (/imprint). What we collect and your rights over it are in our Privacy Policy and KVKK Information Notice (/privacy-policy). Last reviewed: 24 October 2026.