Scalable's primary data center sits in Frankfurt, with secondary regions in Madrid and Paris. Customer data is pinned to the EU at the database level — not just by configuration, but by contract, audit log, and physical impossibility. GDPR Article 32 is the floor, not the ceiling.
Customer data is routed, stored, indexed, and backed up inside EU borders — physically, not just logically. Even encrypted backups never leave. Even support staff lookups are EU-only.
Every customer Postgres cluster lives in Frankfurt, with synchronous replicas in Madrid and Paris. Writes don't return until the data is in two facilities.
Application compute runs only on EU-region nodes. We physically can't fail over to US/AP regions for EU-pinned services — the network ACL refuses.
Support, on-call, and incident response for EU-pinned customers is staffed exclusively by team members based in the EU. Logs and tickets are partitioned the same way.
Standard Contractual Clauses aren't enough for us either. We sign a GDPR Article 28 Data Processing Agreement with every EU-pinned customer — no riders, no exceptions.
Every request from an EU-pinned customer takes exactly this path. We chose simplicity over flexibility — the egress to a US edge isn't "rare," it's literally impossible via firewall.
Every framework here is audited by a Big Four firm, refreshed annually, and the latest reports are downloadable from the dashboard.
Signed automatically with every EU-pinned plan. Standard Contractual Clauses included. Sub-processor list is public and changes are notified 30 days in advance.
Audit kicked off Jan 2026 with a Big-Four assessor. Scope covers the whole platform, the Frankfurt facility, and our Madrid HQ. Certification target Q4 2026.
12-month observation window opened March 2026 with E&Y. Type I bridge letter available on request from Q4 2026; Type II report expected Q1 2027.
Germany's federal information security office standard. Required for most German public sector contracts and several federal banks.
The EU's financial regulation that came into force in 2025. We're a registered ICT third-party provider — relevant if you're a regulated EU financial entity.
If you absolutely must transfer data to the US for some downstream tool, the framework is in place. We don't use it for EU-pinned plans — that's the whole point.
Postgres primary in Frankfurt. Synchronous replicas in Madrid and Paris. Cold backups in Frankfurt only. No US, no UK, no AP — by design.
Add the residency block to any service. We refuse to schedule it anywhere except the regions you list, and the dashboard shows a green EU-pinned badge from the next deploy onward.
[service.web] name = "web" image = "web:latest" [service.web.residency] # pin compute + data to the EU. nothing else allowed. regions = ["eu-fra", "eu-mad", "eu-par"] data = "eu-only" support = "eu-only" audit_log = "eu-fra" # retention = 7y default backups = "eu-fra" [service.web.postgres] primary = "eu-fra" replicas = ["eu-mad", "eu-par"] sync = 2 # commit when 2/3 in sync
$ scalable deploy ▸ residency.check ok eu-only · 3 regions ▸ audit.lock ok eu-fra · 7y retention ▸ postgres.provision ok primary eu-fra + 2 replicas ▸ support.scope ok eu staff only ▸ acl.deploy ok non-eu egress = drop deployed in 52s · pin badge active verify at scalable.systems/p/your-org/web/residency └─ refusing to schedule pod to us-east, ap-sin (4 attempts blocked)
Verbatim from our last 14 customer audits. Answers below.
For EU-pinned customers, we act exclusively as a data processor under GDPR Article 28 — never as a controller. The signed DPA (sent automatically on plan creation) names you as the controller and details every category of processing.
We don't profile, infer, or aggregate customer data for our own use. The only data we collect about your users is what you tell us to: structured logs, traces, and observability metrics that you yourself emit and configure.
Two windows. Inside the 14-day grace period, data is soft-deleted — you can restore the project. After grace, all data is overwritten with random bytes (NIST 800-88r1 Clear), and the backing blocks are scheduled for hardware-level wipe within 90 days. Audit logs of the deletion are kept the standard 7 years.
For accelerated deletion (e.g. court order), we publish a CLI command that completes in <1 hour: scalable purge --confirm-no-recovery. A signed Certificate of Destruction lands in your inbox.
Three categories of humans: Digital Realty FRA15 facility staff for power/cooling, two named Scalable SREs (Berlin-based) for hardware swaps, and auditors with chaperoned access for the annual ISO 27001 review.
No customer-facing personnel — sales, support, product — has physical access. No remote console access exists outside the EU. Every entry is biometric + RFID + camera, logged to the audit trail, and surfaced in your dashboard if it touches your hardware.
If a request comes from outside the EU, we refuse and notify you within 24 hours — unless the request is from a jurisdiction with a mutual legal assistance treaty (MLAT) with Germany. From the US specifically, we require a court order routed through the German Federal Ministry of Justice.
In the past 24 months, we've received zero such requests. If we ever do, our annual transparency report will document it.
Synchronous Postgres replicas in Madrid and Paris promote within 90 seconds of detected primary loss. Compute auto-fails over to Madrid (or Paris if Madrid is also down). Your service continues — slightly higher latency for EU-West users, no data loss, RPO of 0.
What does not happen: your data does not move to a US or AP region. The system would rather refuse traffic for some users than violate residency. This is enforced by the firewall — there's no human override.
"BaFin signed off in nine weeks. Their auditor said it was the easiest review they'd run all year — most of the questions are answered by the contract we already had."
Pin a service to the EU in one line of config. We'll handle the contract, the audit, and the physical impossibility of egress.