Operated in Europe
Control plane, GitLab, managed servers, secrets and backups run in Germany and the EU. Support and administration sit in Cologne.
Solution
GDPR compliant hosting without a detour through US clouds
Data protection questions usually show up in your customer’s procurement process. The platform runs your repositories and deployments inside the EU and provides a data processing agreement.
- Platform and managed servers operated in Germany and the EU
- Data processing agreement and technical and organisational measures as ready documents
- Bring your own server over SSH when data has to stay in your environment
Start for free. No credit card required.
In short
The platform provides the technical and contractual groundwork. Assessing your specific processing remains your responsibility.
- Operated in the EU: control plane, GitLab, managed servers and backups sit in Germany and the EU.
- Contracts are ready: generate a DPA and the measures description directly inside the platform.
Handling data protection yourself versus working with the platform
This shows how each task lands on your desk without a platform and how much of it the Application Platform covers. It is not a legal assessment of your situation.
| Task | With the Application Platform | Set up manually |
|---|---|---|
| Deciding where processing happens | Fully covered: Platform operated in Germany and the EU, servers freely selectable | Not offered: Check every service individually, with defaults often outside the EU |
| Data processing agreement | Fully covered: Agreement in place for platform operations, personalised documents generated in the platform | Not offered: Request, review and file one for every single provider |
| Documenting technical and organisational measures | Fully covered: A description of the measures for platform operations is available as a document | Not offered: Write it yourself and revise it after every change |
| Running on your own servers | Fully covered: Your own server over SSH or a managed server, with access staying with you either way | Partly covered: Possible, but Docker, proxy, SSL, firewall and backups are on you |
| Managing access inside the team | Fully covered: Roles, organisations and project memberships managed in one place | Not offered: Separate user management per tool, with permissions drifting apart |
| Evidencing changes | Fully covered: Audit log for relevant changes, deployments as configuration in the Git history | Partly covered: Scattered logs, rarely a shared view across project and infrastructure |
| Storing credentials and secrets | Fully covered: Credentials held centrally in the project with permissions per role | Partly covered: Spread across CI variables, password managers and local files |
| Explaining data flows to customers | Fully covered: Sub-processors and processing locations for platform operations are documented | Not offered: Research and assemble the picture for each service in use |
| Deletion and exit | Fully covered: Repositories, GitOps configuration and servers belong to you, with full code ownership | Partly covered: Depends on the export options each provider happens to offer |
| Legal assessment of your case | Partly covered: Not part of the service; the platform supplies groundwork and evidence | Partly covered: Also a job for your company or your legal advisers |
Green means fully covered, amber partly, grey not offered. This describes the scope of the platform and does not constitute legal advice.
As of 10 August 2026. This comparison describes typical workflows and can differ from project to project.
What actually helps in a data protection review
The points procurement and security teams ask about again and again.
Contracts and evidence
A data processing agreement, the technical and organisational measures and a scope overview can be generated for your organisation.
Connect your own server
When application data has to stay in your own environment, attach your server over SSH. Docker, reverse proxy, SSL, firewall and backups get set up on it.
Roles and permissions
Environments and deployments live as configuration in the Git history, so what runs in production can be evidenced rather than described.
-
Anna WeberAdministrator
Organization, members & billing
-
Max SchneiderDeveloper
Code, Git & deployments
-
Tom RichterTester
QA on dev & staging
-
Paul KleinCustomer
Customer app & feedback
How to approach this in a project
This order works well when data protection should not be an afterthought.
-
Decide where things run
Choose whether your application runs on a managed server or on your own machine. Both can be connected to the same project.
-
Generate the contracts
Download the data processing agreement and the description of technical and organisational measures from the platform and add them to your documentation.
-
Sort out access
Assign roles inside the organisation, keep project credentials in one place and remove personal logins from scripts and local files.
-
Document the data flows
Record which optional services you enable in the project, such as your own SMTP or Sentry. Those processings are yours to assess.
-
Close the review
Have the package checked by your data protection adviser. The platform supplies the technical and contractual basis; the judgement stays with you.
Frequently asked questions
Does running on the Application Platform make my project GDPR compliant?
No, and no provider can honestly promise that. The platform supplies the groundwork: EU operations, a data processing agreement, documented sub-processors and an audit log. Whether your processing is lawful stays your own assessment, not legal advice.
Where exactly is my data processed?
The primary processing location is Germany and the EU: control plane, GitLab, managed servers and backups. Any service with a transfer outside the EU, such as payment processing, is named in the compliance overview and covered contractually.
Do I get a data processing agreement?
Environments and deployments live as configuration in the Git history, versioned and tied to a commit. The audit log additionally records changes to projects and permissions, so you can evidence rollouts and access changes.
Check the groundwork yourself
Register for free, create a project and look at the contracts, the role model and the audit log inside the platform.
Start for free. No credit card required.