EU Data Residency

All Sitenyx data is stored in PostgreSQL databases hosted in European data centers. We use infrastructure providers that maintain ISO 27001 certified facilities within the EU, ensuring your business data remains within EU jurisdictional boundaries at all times.

Sitenyx' own infrastructure — databases, cache, message queue and file storage — runs within the EU. AI prompt content and SMS are handled by sub-processors in the United States under SCCs, see the sections below. Here is where each component operates:

• PostgreSQL Databases Primary data storage for the platform's microservices, hosted in EU data centers with automated backups.
• Redis Cache In-memory caching and session management, running on EU-based infrastructure.
• RabbitMQ Message queue for async service communication, hosted within the EU.
• File Storage Cloudflare R2 under EU jurisdiction for all uploaded files and media — including encrypted guest-ID documents.

Your application database, file storage, and backups stay within EU borders. AI prompt content sent to the platform's AI features (the AI page builder, AI content tools, site chat, voice receptionist, menu translation, photo culling and the AI assistant) is processed by Anthropic, PBC in the United States under the European Commission's Standard Contractual Clauses (SCCs). Anthropic does not retain or train on your prompts (Anthropic Commercial DPA art. 5). The full sub-processor list forms part of our Data Processing Agreement (DPA), which is available on request — email [email protected].

Traffic between the browser and the platform is encrypted with TLS (1.2/1.3), terminated at our edge proxy. Files and media are encrypted at rest with AES-256 by our storage provider, Cloudflare R2 in the EU jurisdiction. Particularly sensitive fields — guest ID documents, health information given with explicit consent, and payment-provider credentials — are additionally encrypted with AES-256-GCM at field level. Databases, cache and message queue run on a closed network that is not reachable from the internet. API keys and credentials are stored in encrypted vaults, never in source code.

We take a database snapshot of each service before every deployment, and the most recent snapshots per service are retained. Snapshots are held within the EU on our own infrastructure with restricted access. Recovery is performed by restoring the most recent snapshot.