Security
Last updated: 5 October 2026
Where customer data lives
All customer data is stored in the European Union.
- Primary: Hetzner Online GmbH, Germany (Falkenstein data centre).
- Backups: Backblaze EU Central region, Amsterdam, Netherlands, encrypted before upload.
- Cloudflare carries traffic (DNS, TLS, DDoS protection) and stores no customer data.
Encryption
Encryption in transit: HTTPS/TLS for all web and API traffic; STARTTLS between Spotzee and Sendmux and on outbound mail whenever the receiving server supports it.
Encryption at rest: every backup is encrypted before it leaves our servers, plus storage-side encryption at the backup provider.
Access
Production access limited to authorised personnel on a least-privilege basis; multi-factor authentication on all hosting, DNS and business accounts; SSH key access to servers.
Network and patching
Databases are closed to the public internet at the firewall; Cloudflare DDoS protection; abusive traffic rate-limited or blocked automatically.
Security updates applied promptly; critical vulnerabilities patched as soon as a fix is available.
Backups and resilience
Live database replica; daily encrypted backups kept 28 days; quarterly restore tests; failed or missed backups alert immediately.
Database backups: 28 days (7 daily, 4 weekly).
Monitoring
Uptime monitored with alerts; public status page https://status.spotzee.com.
Provider certifications
Certifications of our providers: Hetzner data centres ISO/IEC 27001:2022; Backblaze SOC 2 Type 2.
Breach notification
We notify affected customers without undue delay and no later than 48 hours after becoming aware of a personal data breach affecting their data, with what happened, the data and people affected, likely consequences and the measures taken. Where the law requires, we also notify regulators.