Transparency
Hosting, DPA and data protection
Anyone evaluating an AI visibility tool asks the same questions: where is the data stored, is there a data processing agreement, which subprocessors are involved, and what leaves the EU. This page answers all four directly and links the documents that let you verify every answer.
The short answers
- Hosted in Germany: a virtual server operated by STRATO AG in a German data center
- Daily encrypted backups stored with Hetzner Online GmbH in Germany
- Data processing agreement under Art. 28 GDPR published openly; acceptance is logged per team with version and checksum
- All subprocessors disclosed, including the AI providers and their safeguards
- Analytics via self-hosted Matomo, cookie-free, with truncated IP addresses
Where the data lives
Achtung.app runs on a virtual server operated by STRATO AG, Berlin, in a data center in Germany. The database and the application run entirely on this infrastructure.
Backups run daily. They are encrypted and stored with Hetzner Online GmbH in Germany, physically separate from the production system, and deleted after two months.
Data processing agreement under Art. 28 GDPR
The data processing agreement is public. You can read it in full before registering, including the technical and organisational measures and the complete subprocessor list.
At registration, acceptance is logged per team with the version number and a checksum of the accepted text, so there is a verifiable record of which version applied at any point.
Which subprocessors are involved
To measure how AI assistants talk about a brand, Achtung.app sends the brand name, domain, keywords and competitor names to the AI providers. Contact details, credentials, IP addresses and payment data are never sent there.
The full list sits in Annex 3 of the data processing agreement, with the contracting entity, role and safeguard for each provider. For customers in the EEA, the Irish entities of OpenAI, Google and Anthropic are the contracting parties.
Storage and transfers, considered separately
Your account data is stored and processed in Germany.
The transfers to the AI providers are a separate matter: some providers are based in the USA or pass data to third countries within their corporate group. These transfers are covered by the EU-US Data Privacy Framework where the recipient is certified, and by EU standard contractual clauses in all other cases. The per-provider details are in the data processing agreement.
Analytics and logs
Website analytics run on self-hosted Matomo on our own infrastructure, without cookies and without fingerprinting; IP addresses are truncated before storage. The full details are in the privacy policy.
To be clear
No tool satisfies the GDPR on its own; it depends on how you use it and what data you enter. That is why Achtung.app discloses exactly what you need for your own assessment: storage location, the data processing agreement, subprocessors and third-country transfers.