blitz.cloud data location and GDPR

Where blitz.cloud stores your apps and data (data centres in the European Union), who operates it, which service providers are involved and how privacy is handled.

blitz.cloud runs on servers in a data centre in the European Union and is operated by BlitzWorks UG (haftungsbeschränkt), a German company in Regensburg. Your apps, their files and their databases are stored there, and backups go to separate storage, also in the EU. Neither BlitzWorks nor the company that runs the data centre has a US parent.

This page describes how the platform is set up. It isn't legal advice, and it doesn't replace the privacy policy.

Where your data is

Data	Where
Your apps, their files and databases	A data centre in the EU, run by a German infrastructure provider. One region today, more planned at other European locations. Files that no app has needed for two days are moved, encrypted, to separate storage with the same provider
Nightly backups of databases, and on Pro of your apps' files	Storage in the EU, separate from the app servers, encrypted before they leave
Your account, sign-in and sessions	Our own Keycloak server, same data centre
Statistics about visits to blitz.cloud	Our own Matomo server at matomo.blitzworks.io, on the same infrastructure
Built images of your GitHub projects	Our own registry. The images sit in the same provider's object storage in the EU, apart from the app servers. We keep the last ten versions that went live, so you can put one back

All servers are rented and operated by BlitzWorks. There is no US hyperscaler underneath. Requests on their way to these servers do pass through Cloudflare, see below.

Service providers

These are the companies involved, what each one is for and what it sees. GitHub, Tailscale and Google for sign-in only come in when you choose to use them, and then under their own terms. Google AdSense shows ads only on the articles of this website; its script also loads on the other pages and in the dashboard, for Google's consent dialog, and asks for no ads there. Neither runs in your apps.

Provider	What for	What they see
Our infrastructure provider, a German company	Servers, network, backup storage	Everything stored on the servers, as the infrastructure provider
Cloudflare	Every request to blitz.cloud, the dashboard, sign-in, the API, the MCP server and your apps' blitz.cloud addresses passes through Cloudflare, which delivers it, protects against attacks, runs our DNS and issues the HTTPS certificates for these addresses. Domains you connect yourself don't go through Cloudflare. Cloudflare Turnstile in the sign-up form and the report form also checks whether a human is sending it	Your IP address, the address you requested, browser details and the content of the request
Google Workspace	Sending our emails from `noreply@blitz.cloud`, such as the address confirmation link or a note that a deploy failed	Your email address and the email's content
Anthropic	Working out what a Docker image needs, writing or repairing a Dockerfile, explaining why a build or start failed, and helping us answer messages, check for abuse and fix incidents	See the next section
Let's Encrypt	HTTPS certificates for domains you connect and for private apps	The domain or address name, which appears in public certificate logs like every certificate does
Stripe	Taking payment for Pro, only if you buy it or start the 14-day trial	Your name, email address, billing address, VAT ID if you give one, and payment details. Card details go straight to Stripe and never reach our servers
Docker Hub and other public registries	Searching and downloading public images	Which public images are looked up and pulled, not who you are
GitHub, Google	Only if you sign in with them, or connect GitHub to build your repositories	What you allow during sign-in, and for GitHub which repositories blitz.cloud may read
Google AdSense	Ads on the articles of this website: docs, guides and comparisons. None in the dashboard at present, and none in your apps	Your IP address, the page requested and browser details. Advertising cookies only if you agree in the consent dialog
Google consent dialog	The consent dialog on the website and in the dashboard	Your IP address, to tell whether the dialog applies in your country, and your choice
Tailscale	Only if you connect it for private apps. Tailscale is your own provider	What it learns about every device on your tailnet: its name, addresses and connection times

Cloudflare, Google, Anthropic, Stripe, GitHub and Tailscale are US companies or part of one, Let's Encrypt is run by a US non-profit, and all of them may process data in the USA.

What Anthropic receives

For the build steps it never receives your account details, your email address or the values of your apps' settings. We use Anthropic's model Claude for some of these steps. What it does receive depends on the step:

When you pick a Docker image: the image's name and version, the ports and folders it declares, and the names of its environment variables.
When we write a Dockerfile for a project that has none, or repair it after a failed build: the repository's name and commit, the list of files, manifest files such as package.json, the start of the README and of the file the program starts in, and after a failure the Dockerfile used and the end of the build output.
When a build or start fails and we explain why: the same project details and the end of the output, plus the app's name and address, the names (not the values) of its settings and the names of your other apps. This also happens for projects that bring their own Dockerfile.
When a project has several Dockerfiles and we work out which one is the app: those Dockerfiles.

For a private repository that means parts of code you have not published. When Claude helps us run the operation, it sees the data a given task needs, such as your message to us, your email address, your plan and the details of your apps. More on this in section 16 of the privacy policy.

Every HTTPS certificate is listed in public certificate logs, as everywhere on the internet. For blitz.cloud addresses that shows your main address name, like lena.blitz.cloud, and for a domain you connect, that domain.

How the platform protects data

Every app runs in its own gVisor sandbox. It runs as root only inside that sandbox and only when its image asks for it, and privileged containers are refused.
Network rules deny everything by default. Apps can't reach other accounts, the platform's internal services, or private networks. The one exception is a device on your own network that you forward to one of your apps in the infrastructure designer, and only that app reaches it.
Databases have no public address and are only reachable from the owner's apps.
Environment variables are encrypted before they're stored.
Backups are encrypted before they leave the cluster.
Sign-in supports passkeys and two-step verification. The admin console of the sign-in server is not reachable from the internet.
Outgoing traffic per app is limited in speed, and apps that mine crypto are paused before they run.
Settings lists every change to your account, including those made by your AI assistant, by GitHub and by us.

Statistics and cookies on blitz.cloud

We count visits to blitz.cloud and the dashboard with our own Matomo, without cookies, with a shortened IP address and without passing anything on. From our server it also counts, per account and under a random number, four steps from sign-up to a paid plan, without email address or name. One cookie, which recognises a returning visitor, is only set if you allow it in the consent dialog. The dashboard reports routes like /apps/:id rather than which app you opened.

This website shows ads from Google AdSense on its articles only: the docs, the guides and the comparisons. The home page, pricing, the legal pages and contact have none, and the dashboard shows no ads at present. Google's own consent dialog asks for your consent. Without it, Google and its partners set no advertising cookies. Third-party vendors, including Google, use cookies to serve ads based on your earlier visits to this or other websites. How Google uses data on its partners' sites is explained there, and you can turn personalised ads off in Google's Ads Settings. You can change your choice at any time under "Cookie settings" at the bottom of the website, or under Settings in the dashboard. There are no ads at sign-in or in your apps.

Your hosted apps are not tracked by us. What your app does with its visitors' data is up to you.

BlitzWorks is subject to the GDPR as a German company, and the data stays in the EU. When you host an app that processes other people's personal data, you are the controller and BlitzWorks processes it on your behalf.

You can download the data processing agreement (Auftragsverarbeitungsvertrag, AVV) as a PDF once you are signed in. It includes the technical and organisational measures and the list of sub-processors. For any other question about data protection, write to hallo@blitzworks.io.

If you host apps for a team rather than yourself, see blitz.cloud for teams.

Your rights

You can ask what we store about you, have it corrected or deleted, and get a copy. You can delete your account and download your data yourself, under Settings. For anything else, write to hallo@blitzworks.io from the account's email address. Details are in the privacy policy.

blitz.cloud data location and GDPR - hosted in the EU