Article 28 processor
You're the data controller. We process on your documented instructions and nothing else. Full stop.
EU / GDPR / Article 28 processor · DPA signed at sign-upGDPR-compliant
GDPR-compliant
by default.
Built and hosted in the EU. Your monitoring data lives on Hetzner in Germany and Finland, not in some us-east bucket you didn't choose. The handful of sub-processors outside that (CDN, email, billing) run under SCCs or UK adequacy. No surprise transfers, no clickwrap DPA buried in the ToS. Create an account and you get an Article 28 processor agreement on day one.
- Entity
- HopplaMünster, Germany
- Hosting
- Hetzner Cloud GmbHGermany + Finland (EU)
- DPA
- Art. 28 GDPRStandard at sign-up
- Data residency
- EUProcessed in the EU
What we commit to01 / PROCESSOR 02 / HOSTING 03 / DPA 04 / TOM 05 / TESTING 06 / RIGHTS
Six promises. In writing.
EU infrastructure
Your monitoring data sits on Hetzner in Germany and Finland. A handful of sub-processors sit outside that — CDN, email, billing, certificates, push and the optional AI analysis — each named below, each under SCCs or UK adequacy.
DPA at sign-up
A short, plain-language Article 28 contract is waiting the moment you create an account. No legal back-and-forth, no waiting on us to countersign.
TOM published
Our technical and organisational measures live at /tom, versioned. Diff what changed between releases instead of taking our word for it.
Security testing
Changes run through CI with security checks and dependency scanning on each build.
Your data rights
Access, rectification, erasure and portability are self-serve from your account. The rest is one email to [email protected].
Where your data livesHosted in Germany
Hosted in Germany
and Finland.
Every bit of customer data, from monitor configs to check results, alerts and status-page subscribers, stays in the EU. Our probes run on Hetzner in Germany and Finland too: they fetch your site, report the result over an authenticated channel and keep nothing else.
- DEDATA
Falkenstein / Nuremberg
Germany
Primary database, API and application, holding all customer data
OP · Hetzner Cloud GmbH
- FIDATA
Helsinki
Finland
Secondary region and uptime probes
OP · Hetzner Cloud GmbH
Your rights
Every right, self-serve.
- Art. 15Right of accessExport everything we hold on you as machine-readable JSON.Where: Account → Export data
- Art. 16Right of rectificationEdit your personal data inline in the dashboard.Where: Account settings
- Art. 17Right to erasure“Delete account” removes your login at once. A team with no other members is purged 30 days later.Where: Account → Delete
- Art. 18Right to restrictionFreeze processing while a dispute is open.Where: [email protected]
- Art. 20Right to portabilityExport monitors, history and incidents in a standard format.Where: Account → Export data
- Art. 21Right to objectOpt out of any non-essential processing. Marketing is opt-in only.Where: Account settings
- Art. 22No automated decisionsNo automation alone ever makes a legally-significant decision about you.Where: —
TOM
Technical & organisational measures.
Required by Art. 32 GDPR, published in full as a versioned document. What follows is the summary.
Confidentiality
- Access control
- MFA available for every account (TOTP, passkeys, recovery codes) and enforceable per organisation. Administrative access is personal and logged.
- Pseudonymisation
- Check results are stored against monitor IDs; tenants are identified by UUID, never by name.
- Encryption (transit)
- TLS 1.3 on our own domains, TLS 1.2 minimum on customer domains. HSTS with a long max-age.
- Encryption (rest)
- Sensitive fields encrypted in the database with AES-256. Volumes and backups encrypted by the infrastructure provider.
Integrity
- Audit logs
- Administrative actions are written to an audit log, retained 365 days, with the payload encrypted.
- Backups
- Daily database backup to separate EU object storage, retained 14 days, with the run monitored so a failure raises an alert.
- Change management
- Every change runs the full test suite and linting in CI.
- Vulnerability mgmt
- Dependency vulnerability audit on every build, plus automated dynamic security scanning of the API and status pages.
Availability
- Redundancy
- Multiple application and worker instances with pod disruption budgets. A second region in Finland runs independent monitoring probes.
- Recovery
- Recovery procedure documented; restore from the daily backup. Full restore exercises are not yet part of the routine.
- Incident response
- Documented P1–P4 process with defined escalation. Status communication via status.hoppla.dev.
- Business continuity
- Documented runbooks for the failure modes we have seen in production.
Sub-processors
The full list. Nothing hidden.
We tell every customer 30 days before adding a new sub-processor. Don't like it? Object, and we'll help you migrate at no charge.
| Entity | Location | Role | DPA / SCCs |
|---|---|---|---|
| Hetzner Online GmbH | Germany + Finland (EU) | Infrastructure hosting, compute and storage, holding all application data | EU — no transfer |
| Cloudflare, Inc. | Global anycast; nearest point of presence, which may be outside the EEA | DNS, DDoS protection, CDN, WAF and TLS termination — processes request and response content in transit | EU SCCs + DPA |
| Mailgun (Sinch) | EU region endpoint | Transactional email for alerts and account email | EU SCCs + DPA |
| Paddle.com Market Ltd | UK / EU | Payments, billing and invoicing (Merchant of Record) | UK adequacy + DPA |
| Let's Encrypt (ISRG) | USA | TLS certificate issuance; domain names also appear in public Certificate Transparency logs | Public certificate authority |
| OpenRouter, Inc. | USA | AI incident analysis, run only when a user asks for one, and the AI summary of the monthly report for teams that switch it on; routes on to a model provider | EU SCCs |
| Google Ireland Ltd / Google LLC | USA | Chrome UX Report API for the performance check; Google Fonts on a status page where its operator selected one | EU SCCs |
| Apple Distribution International Ltd | USA | Push notifications to the iOS app | EU SCCs |
DPASign once.
Sign once.
Stays signed.
Every account gets an Article 28 Data Processing Agreement at sign-up, in German or English. Email us if your legal team wants to redline it.
- 1. The Controller authorises the Processor to engage the Sub-Processors listed on this page.
- 2. The Processor shall notify the Controller at least thirty (30) days in advance of any new Sub-Processor.
- 3. The Controller has the right to object, in which case the Processor offers reasonable mitigation including assisted migration at no charge.
… full agreement with Schedule A (TOM) and Schedule B (Sub-Processors).
Data protection contact
Talk to a human. Ours.
SUPERVISORY AUTHORITY
LDI NRW
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
You can take a complaint straight to the LDI NRW. We'd rather you came to us first, but the right is yours, not ours.
This page is a summary and does not constitute legal advice · consult your own DPO for controller-side obligations
Early accessMonitoring,
Get early access Monitoring,
hosted in the EU.
Hoppla runs on Hetzner in Germany and Finland. Join the early-access list and we’ll invite you as places open.