GDPR-compliant backend: how to host app data in the EU and choose the right provider

Every app that stores names, email addresses, orders or support tickets processes personal data. In the EU that means the General Data Protection Regulation applies, and the backend, where the data is stored and processed, is where most of the obligations land. This post explains what makes a backend GDPR-compliant, why the location of your data matters, what to check when you choose a provider and how we host data for pylo customers.

This post is a practical guide, not legal advice. For decisions about your specific processing, talk to your data protection officer or a lawyer.

What is a GDPR-compliant backend?

No backend is GDPR-compliant on its own. Compliance belongs to the company that decides why and how personal data is processed, the controller. What a backend provider can do is make compliance possible and easy to prove. In practice a GDPR-compliant backend gives you:

• A data processing agreement under Art. 28 GDPR that names the provider as your processor and sets out its duties

• Clear data location for the database, files, backups and logs

• A legal basis for any transfer outside the EU or EEA, if one happens at all

• Appropriate security measures under Art. 32 GDPR: encryption, access control, backups, monitoring

• Tools for data subject rights: finding, correcting, exporting and deleting a person's data

• Fast breach notification, so you can meet your own 72-hour deadline towards the supervisory authority

• Transparency about subprocessors, the other companies your provider uses

Does GDPR require hosting in the EU?

Not strictly. GDPR allows transfers to countries outside the EU and EEA, but only with a legal basis: an adequacy decision by the European Commission, such as the EU-US Data Privacy Framework for certified US companies, or safeguards such as the EU Standard Contractual Clauses. Each of these adds work for you: checking certifications, documenting transfer impact assessments and watching for legal changes.

That last point is not theoretical. The Court of Justice of the EU struck down the previous EU-US arrangement, the Privacy Shield, in 2020 in its Schrems II ruling, and its predecessor Safe Harbor in 2015. Companies that relied on them had to rework their contracts overnight. Hosting in the EU with an EU provider removes the transfer question for your core data entirely.

Why an EU region is not always enough

Many US providers offer an EU region, and choosing it is a good first step. It does not remove every risk. A company under US jurisdiction can be required by US law, such as the CLOUD Act, to hand over data it controls, even when that data sits on servers in Frankfurt or Dublin. An EU region answers the question "where is the data?". It does not answer "which law applies to the company that runs it?".

Whether that residual risk matters depends on your data and your customers. For a marketing site it rarely does. For health data, HR records, data of public sector clients or customers who ask about it in every security questionnaire, it often does. A provider that is itself an EU company, running on EU-owned infrastructure, gives you the simplest answer.

Why it matters for your business

• Fines. Serious violations can be fined up to €20 million or 4% of worldwide annual turnover, whichever is higher.

• Sales cycles. B2B customers in the EU send security and privacy questionnaires before they sign. "Our data is hosted in Germany by a German company" closes that section in one line.

• Less paperwork. Without third-country transfers you do not need transfer impact assessments for your core data, and your records of processing stay short.

• Trust. End users increasingly ask where their data goes. A clear answer is part of the product.

• Stability. EU hosting does not depend on the next court ruling about transatlantic data flows.

How to choose a GDPR-compliant backend provider

Use this checklist when you compare providers. Ask for written answers, not marketing pages.

How pylo hosts your data

pylo is built and operated by Okeano GmbH, a German company based in Lippstadt. Our contracts and our data processing agreement are governed by German law. Here is how we answer the checklist above. Everything below is part of our published data processing agreement and subprocessor list.

Where your data lives

• Databases, data models and all content data run exclusively in Hetzner data centres in Falkenstein and Nuremberg, Germany. Hetzner Online GmbH is a German company, so no third-country transfer is involved. The data centres are ISO/IEC 27001 certified.

• Backups are taken every 6 hours, kept for 14 days and encrypted with a key we control before they leave the server. They are stored at a different German location from the production servers, and the storage provider cannot decrypt them.

• Uploaded files are stored in an external object storage in the EU region.

• Transactional email such as sign-up and password reset is sent from our own mail servers in Germany, without an external email provider.

Contract and process

• DPA included. The data processing agreement under Art. 28 GDPR is part of our terms. You do not need to sign anything separately, and we provide a signed copy free of charge on request.

• 48-hour breach notification. We inform you of any personal data breach without undue delay and at the latest within 48 hours, leaving you time for your own 72-hour deadline.

• 30 days' notice for subprocessor changes, with a right to object and, if we cannot agree, to terminate the affected service.

• Support access only with your approval. Our staff do not have standing access to your content. Support access is granted by you case by case, limited in time and recorded in an audit log.

• No AI training. We do not use your data to train or improve AI models, and we do not send it to AI providers unless you explicitly enable such a feature.

• Clean exit. You can export your data during the contract and for 30 days after it ends. After that it is deleted from production, and backups containing it are overwritten within a further 14 days.

Conclusion

GDPR does not force you to host in the EU, but every step outside it adds legal work and leaves you exposed to the next court ruling or foreign access law. An EU region from a US provider solves the location question. An EU company on EU infrastructure also solves the jurisdiction question. Whatever you choose, ask for the DPA, the subprocessor list, the backup and deletion rules and the breach notification time in writing, and check where backups and logs go, not just the main database.

If you want a backend where those answers are already published, pylo runs your database in Germany, under European law, with a DPA included in the terms and full GDPR-compliance.