# Trust and data handling Everything a security review or a procurement questionnaire usually asks, in one place. Each answer links to the document that makes it binding, so this page summarises and never adds a promise of its own. ## Where the data lives | What | Where | |---|---| | Compute, database, report files | Hetzner, Nuremberg (Germany) | | Edge | Cloudflare, with EU-region cache rules; birth data passes in transit and is not stored there | | Administration | From Ukraine, over SSH with a key. GDPR Chapter V counts that as a transfer, so the DPA covers it with the Standard Contractual Clauses | Details and the reasoning: [GDPR / EU residency](/en/eu/). ## Who processes it | Party | What it gets | Named in | |---|---|---| | Hetzner Online GmbH | everything we store, as the host | [DPA](/en/legal/dpa/) section 4 | | Cloudflare, Inc. | HTTP requests on their way to our server | [DPA](/en/legal/dpa/) section 4 | | AI providers | only the computed chart (signs, houses, aspects) on the AI endpoints; no birth date, time, coordinates, name or place | [Privacy policy](/en/privacy/) section 8 | | Brevo | your account email, to send service mail | [Privacy policy](/en/privacy/) section 8 | | Monobank, LiqPay | the account owner's payment details; never birth data | [Privacy policy](/en/privacy/) section 8 | The DPA lists only the first two because only they touch the data of your API requests. The rest process account data, where we are the controller rather than you. ## How long we keep it | Data | Kept | |---|---| | Request log (no request parameters) | 30 days | | PDF report files (`/v1/reports/*`), which hold what you sent for them | 24 hours, or the `retain_days` you set, up to 90; deletable sooner | | AI audit log | 90 days | | Daily usage counters | 365 days | | Account | until you delete it; deletion can be undone for 30 days, then it is erased | | Payment records | 1095 days, as Ukrainian tax law requires | | Encrypted backups | rotate out within 90 days | You delete the account yourself, in the dashboard or with `DELETE /v1/me/account`. Source: [Privacy policy](/en/privacy/) section 5 and [DPA](/en/legal/dpa/) sections 2 and 9. ## How it is protected - TLS only; plain HTTP is redirected. - Passwords are hashed with bcrypt. - API keys have been stored only as a SHA-256 hash since 2026-10-15, so a key is shown once, when it is created. Lose it and you rotate it; nobody, us included, can read it back. - IP addresses are stored as a salted SHA-256, never in the clear. - The database listens on loopback only, with a separate account per consumer. - Backups are encrypted with AES-256 before they leave the machine. - A breach that affects your data is reported to you without undue delay. Source: [DPA](/en/legal/dpa/) sections 5 and 8. ## Contract The [Data Processing Agreement](/en/legal/dpa/) under GDPR Article 28 comes with any paid plan, from Indie. You read it, accept it with a button in the dashboard, and download a PDF that carries the acceptance record. No sales call and no countersigned paper needed: Article 28(9) accepts the electronic form. ## Availability - Live state and 90 days of history: [status.astroway.info](https://status.astroway.info/), described on [Status](/en/status/). - Uptime commitments and credits by plan: [SLA](/en/sla/). ## Contacts - Security incidents: [security@astroway.info](mailto:security@astroway.info) - DPA and legal: [legal@astroway.info](mailto:legal@astroway.info) - Your data and your rights: [api@astroway.info](mailto:api@astroway.info)