Data Residency & Sovereignty

Version 1.2 | Last Updated: January 2025

Where your data lives. ClientFlow stores all data in the European Union (Frankfurt, Germany) to ensure GDPR compliance and data sovereignty for European customers.

Data Location Summary

Data Type	Primary Location	Backup Location	Provider
Database	Frankfurt, Germany	Helsinki, Finland	Hetzner
Files	EU Regions	Global (EU preference)	Cloudflare R2
Application	Frankfurt, Germany	N/A (stateless)	Hetzner VPS
Frontend	Global CDN	Primary: Frankfurt	Vercel

Key Points

EU Data Residency: All customer data stored in EU (Frankfurt)
GDPR Jurisdiction: EU data protection laws apply
No US Storage: Primary data NOT stored in USA
Standard Contractual Clauses: Protect any non-EU transfers

Why Data Residency Matters

Regulatory Compliance

GDPR (EU): Storing in EU = automatically compliant
KVKK (Turkey): EU storage acceptable (adequate protection)
HIPAA (USA): No location requirement if secure

Data Sovereignty

Protected by GDPR (strongest data protection globally)
No US CLOUD Act access to EU-stored data
No warrantless surveillance (requires EU court order)

Geographic Redundancy

Your data is replicated across two EU locations for disaster recovery:

Primary: Frankfurt, Germany (active)
Secondary: Helsinki, Finland (standby replica)
Replication: Real-time (<1 second lag)
Failover: Automatic (<5 minutes)

Distance: ~1,200 km between datacenters protects against regional disasters while maintaining low latency (~20ms).

Sub-Processor Locations

Sub-Processor	Location	Data Type	Safeguards
Hetzner	Germany (EU)	All data	GDPR (EU law)
Cloudflare	EU (primary)	Files	SCCs, DPA
iyzico	Turkey	Payment tokens	SCCs, KVKK
Resend	USA	Email address, name	SCCs, DPA

Schrems II Compliance

ClientFlow implements supplementary measures for any USA transfers:

Encryption: All data encrypted in transit (TLS 1.3) and at rest (AES-256)
Data Minimization: Only transfer necessary data
Pseudonymization: IP addresses anonymized in logs
Contractual: SCCs with indemnification clauses

Data Export

Export your data at any time via Dashboard → Settings → Privacy → Export Data:

Formats: JSON, CSV, PDF
Contents: All client records, payments, appointments, files, audit logs
Delivery: Download link via email within 1 hour

Contact

Data Residency Questions: dpo@clientflow.center

EU-Only Hosting Request: sales@clientflow.center

Read time: ~8 minutes | Audience: IT Security, Compliance Officers

Data Residency - Soevereiniteit & Compliance