Infrastructure and jurisdiction

02/10/2026

Current main Hetzner hosting locations are Germany and Finland. Facility changes follow the DPA and an update to this information; identifying current countries is not a commitment to a permanent location.

A daily backup process uses Hetzner and an additional internal TidyBook process. They are kept on a rolling thirty (30) day cycle: each new daily backup replaces the copy from 30 days earlier. Access is restricted; recorded deletions are reapplied after a restore.

Brevo handles service email, and Google Firebase/FCM and Apple APNs handle notifications, and Google Gemini API supplies optional AI assistance, where enabled. Information on applicable contracting entities and access locations is available from [email protected].

Backups and restoration have technical limitations and do not guarantee zero loss or successful recovery of every copy; Terms of Service section 11 applies.

Basic safeguards

SSL/TLS, restricted authorised access, separation of businesses’ data, secure password hashing, event logging and daily backups are applied. Access from outside the EEA requires a lawful transfer mechanism and necessary contractual/technical protections.

Government requests are assessed for lawfulness and conflicts with EU/member-state law. Only lawfully necessary information is supplied and the Customer is notified where permitted. Jurisdiction information is updated when it changes. Adding or replacing a subprocessor follows the DPA’s notice-and-objection procedure.