Server Location: Germany
Content Mate operates its entire infrastructure in German data centers of Hetzner Online GmbH.
Nuremberg & Falkenstein Data Centers
All application servers, databases (PostgreSQL), caches (Redis) and media storage are operated exclusively in Hetzner data centers in Nuremberg and Falkenstein, Germany.
ISO 27001 Certified (Hetzner)
Hetzner Online GmbH is certified to ISO 27001 and SOC 2 Type II. Data centers feature physical access control, CCTV, 24/7 security staff, and redundant power supply.
Encrypted Transmission
All data transmissions are encrypted via TLS 1.2+. Passwords are hashed with bcrypt. OAuth tokens are stored encrypted. Media files are secured with server-side encryption.
No Third-Country Transfers
Application, analytics, and usage data never leaves EU jurisdiction. The only exception: payment data via Stripe (secured under the EU-US Data Privacy Framework).
Workspace-Based Data Isolation
Each workspace is separated by strict database isolation. All database queries are filtered by workspace ID. Multi-tenant architecture following the principle of least privilege.
Automated Backups
Regular encrypted database backups with a backup rotation of max. 90 days. Redis persistence for queue data. Full data deletion within 30 days after contract termination.
Sub-Processors
A complete list of all sub-processors handling personal data within Content Mate.
| Provider | Purpose | Processing Location | Certification |
|---|---|---|---|
| Hetzner Online GmbH | Cloud hosting: application servers, PostgreSQL, Redis, object storage (S3-compatible) | Germany (EU) | ISO 27001, SOC 2 Type II |
| Stripe, Inc. | Payment processing and subscription management (email, name, payment data) | EU & USA | PCI DSS Level 1, EU-US DPF (Art. 45 GDPR) |
Changes to this list are communicated at least 4 weeks in advance in writing (per §8 DPA). Social media platforms (Meta, TikTok, LinkedIn) are independent controllers, not sub-processors.
Compliance at a Glance
Content Mate is built for organizations that require the highest level of data protection.
Data Processing Agreement (DPA) Included
Every Content Mate customer automatically receives a legally binding DPA under Art. 28 GDPR — based on the official BfDI template (Version 2.1). No extra work, no additional cost.