Infrastructure and protection against third-country access
This page states where protol.io is operated, which providers are involved, which legal systems they are subject to, and how we protect your data against access by authorities of third countries that would conflict with the law of the EU or of a Member State.
As of October 31, 2026
In short
Some of our service providers belong to groups headquartered in the USA. Your content is nevertheless processed in the EU, in Frankfurt am Main. Four protective measures apply:
- Contractual: our cooperation with service providers is regulated by contract, including the basis for transfers to third countries.
- Encryption: connections, database and file storage are encrypted.
- Access control: access is limited to what is necessary and is logged.
- Review of authority requests: the managing director reviews every request from an authority before any data is released.
The details are in the following sections.
Infrastructure in use
| Provider | Service | Seat | Where processing takes place |
|---|---|---|---|
| Hetzner Online GmbH | Servers for the web application and the sync service for the mobile app; encrypted backups | Germany | Data center in Falkenstein, Germany |
| Supabase Pte. Ltd. | Database, sign-in, file storage (photos, videos, signatures, attachments), data backup | Singapore | EU, Frankfurt am Main region (AWS eu-central-1). Some processing, for example for support and operations, can take place outside the project region under Supabase’s terms. |
| Amazon Web Services EMEA SARL | AI language models through Amazon Bedrock, only if your organization has enabled AI features | Luxembourg | EU: Frankfurt am Main, processed through EU inference profiles that route only to EU regions |
| Anthropic Ireland, Limited | Provider of the language models (Claude) used through Amazon Bedrock | Ireland | Processing runs on AWS infrastructure. According to AWS, the model provider has no access to inputs and outputs in the operating model in use. |
| Plus Five Five, Inc. (Resend) | Sending emails (invitations, notifications, emails from the sign-in service) | USA | USA (account and delivery data) |
| Apple Inc. | Optional technical push service for iOS (Apple Push Notification service): delivering short notices to the mobile app when users enable push notifications | USA | Not stated by Apple for this service. For individuals in the EEA, Apple’s general privacy policy names Apple Distribution International Limited (Ireland) as the responsible company. |
| Google LLC | Optional push service for Android (Firebase Cloud Messaging): delivering short notices to the mobile app when users enable push notifications | USA | Global Google infrastructure; processing outside the EEA is also possible, in particular in the USA. Restriction to the EU is not assured. |
The binding list of the sub-processors that process personal data on our customers’ behalf is Annex 1 of the data processing agreement, with the transfer basis for each provider. This table also names the model provider and the optional push service for iOS; the latter is not carried there as a sub-processor (see “Legal system”).
Which data goes where
- Your content – audits, answers, photos, videos, signatures, attachments and user data – is stored in the database and file storage in Frankfurt am Main. Backups are stored encrypted in Falkenstein.
- AI features run only if your organization has approved them. Requests go only to models in the EU. Without approval, no data is sent to the AI provider.
- Emails go through Resend in the USA: name, business email address and the content of invitations and system notifications.
- Only if users enable push notifications on iOS, short notices are sent to the device through the Apple Push Notification service (APNs). The transmission is limited to technical device and app identifiers, fixed notification texts (for example “New audit assigned”) and, where applicable, technical reference identifiers; customer content such as names, location names, audit titles or free text is not sent as a push message.
- Only if users enable push notifications on Android, short notices are sent to the device through Google’s Firebase Cloud Messaging (FCM). A Firebase installation or push identifier, technical app identifiers, standardized notification texts and, where applicable, technical reference identifiers are processed; names, location names, audit titles and free text are not transmitted in the push content.
Legal system
Lido Apps UG (haftungsbeschränkt), the provider of protol.io, has its seat in Potsdam, Germany, and is subject to German and EU law. Hetzner, Amazon Web Services EMEA and Anthropic Ireland have their seats in the EU. Supabase (Singapore) and Resend, Apple and Google (USA) have their seats in a third country and are also subject to its law.
The transfer basis for data that goes to a provider in a third country is stated in Annex 1 of the data processing agreement where it has been established.
Push notifications on iOS are an optional technical service. APNs is provided by Apple Inc. (USA) as part of the Apple Developer Program. According to Apple’s general privacy policy, Apple Distribution International Limited in Ireland is responsible for the personal data of individuals in the European Economic Area; Apple describes its own international data transfers as using standard contractual clauses. On the basis of the contract documentation currently publicly available, APNs is not carried in Annex 1 of the data processing agreement as a sub-processor proven by contract under the General Data Protection Regulation. Further information is in the privacy policy.
Push notifications on Android are an optional service. Google processes the data required for delivery as a sub-processor on the basis of the Firebase Data Processing and Security Terms (Annex 1 of the data processing agreement). Processing on global infrastructure and in third countries, in particular the USA, is possible. For the relevant transfers, Google uses the transfer mechanisms applicable under its contractual terms, in particular the EU-U.S. Data Privacy Framework for appropriately certified recipients and otherwise appropriate standard contractual clauses. Google’s further sub-processors follow the list that Google currently publishes. Further information is in the privacy policy.
Measures against third-country access
We reduce the risk that authorities of third countries access your data without a legal basis under EU or German law through technical, organizational and contractual measures.
Technical
- Your content is stored and processed in the EU. Requests to AI models are technically restricted to models in the EU.
- Encryption: all connections are encrypted (TLS). Database and file storage are encrypted at rest. The nightly backup is encrypted on our server before it leaves it; we hold the key.
- Access restriction: tenant separation at database level, database connections only from the application server, server access only with an SSH key, multi-factor authentication for our administrative accounts at Supabase, Hetzner and Amazon Web Services. The key with full database rights is never delivered to a browser or the mobile app.
Organizational
- We access your data only when operations, troubleshooting or a support case require it. The support view starts only with a stated reason; every access is logged, and the log is part of your data export.
- Requests from authorities about your data are reviewed by the managing director before any data is released. We release data only if there is a valid legal basis under EU or German law, limit the release to what is demanded, and inform you unless the law forbids it.
Contractual
- We regulate our cooperation with sub-processors by contract; for transfers to third countries, Annex 1 of the data processing agreement states the transfer basis where established, for example EU standard contractual clauses. We announce changes to sub-processors in advance, and you can object to them.
- For the AI features, it is excluded by contract that your content is used to train models.
Limits
For providers with a seat in a third country, access under that country’s law cannot be ruled out by our measures alone. That is why we keep the data in the EU, encrypt it, restrict access, and regulate our cooperation with the providers by contract.
Keeping this page current, and questions
We update this page when providers, regions or measures change. How we process data ourselves as a controller is described in the privacy policy. We answer questions at info@protol.io.