blitz.cloud data location and GDPR - hosted in Germany

Where blitz.cloud stores your apps and data (Hetzner, Falkenstein, Germany), who operates it, which service providers are involved and how privacy is handled.

blitz.cloud runs on servers in Hetzner's data centre in Falkenstein, Germany, and is operated by BlitzWorks UG (haftungsbeschränkt), a German company in Regensburg. Your apps, their files and their databases are stored there, and database backups go to separate Hetzner storage. Neither BlitzWorks nor Hetzner has a US parent company.

This page describes how the platform is set up. It isn't legal advice, and it doesn't replace the privacy policy.

Where your data is

Data	Where
Your apps, their files and databases	Hetzner Online GmbH, data centre Falkenstein (fsn1), Germany
Nightly database backups	Hetzner Storage Box, separate from the app servers, encrypted with restic
Your account, sign-in and sessions	Our own Keycloak server, same data centre
Statistics about visits to blitz.cloud	Our own Matomo server at matomo.blitzworks.io, on the same infrastructure

All servers are rented and operated by BlitzWorks. There is no US hyperscaler underneath.

Service providers

These companies process data on our behalf, and only for the stated purpose.

Provider	What for	What they see
Hetzner Online GmbH, Germany	Servers, network, backup storage	Everything stored on the servers, as the infrastructure provider
Resend	Sending account emails, such as the address confirmation link, from `mail.blitz.cloud`	Your email address and the email's content
OpenRouter	Working out what a Docker image needs when you pick one	The image name and tag, its declared ports and volumes, and the names of its environment variables. No information about you.
Let's Encrypt	HTTPS certificates	Your address name, which appears in public certificate logs like every certificate does
Docker Hub	Searching and downloading public images	Which public images are looked up and pulled, not who you are
GitHub, Google	Only if you choose to sign in with them	What you allow during sign-in

Resend and OpenRouter are US companies. The OpenRouter call contains only public metadata about a public image, never your account details.

Note that only your main address name, like lena.blitz.cloud, is in certificate logs. App subdomains are covered by a wildcard certificate, so their names are not published that way.

How the platform protects data

Every app runs in its own gVisor sandbox, as a non-root user with all Linux capabilities dropped.
Network rules deny everything by default. Apps can't reach other accounts, the platform's internal services, or private networks.
Databases have no public address and are only reachable from the owner's apps.
Environment variables are encrypted before they're stored.
Backups are encrypted before they leave the cluster.
Sign-in supports passkeys and two-step verification. The admin console of the sign-in server is not reachable from the internet.

Statistics and cookies on blitz.cloud

We count visits to blitz.cloud and the dashboard with our own Matomo, without cookies, with a shortened IP address and without passing anything on. One cookie, which recognises a returning visitor, is only set if you allow it in the banner. The dashboard reports routes like /apps/:id rather than which app you opened.

Your hosted apps are not tracked by us. What your app does with its visitors' data is up to you.

BlitzWorks is subject to the GDPR as a German company, and the data stays in the EU. When you host an app that processes other people's personal data, you are the controller and BlitzWorks processes it on your behalf.

If you need a data processing agreement (Auftragsverarbeitungsvertrag, AVV), a list of technical and organisational measures, or have any other question about data protection, write to hallo@blitzworks.io.

Your rights

You can ask what we store about you, have it corrected or deleted, and get a copy. Account deletion isn't a button in Settings yet, so write to hallo@blitzworks.io from the account's email address. Details are in the privacy policy.