Trust and data handling
Everything a security review or a procurement questionnaire usually asks, in one place. Each answer links to the document that makes it binding, so this page summarises and never adds a promise of its own.
Where the data lives
Section titled “Where the data lives”| What | Where |
|---|---|
| Compute, database, report files | Hetzner, Nuremberg (Germany) |
| Edge | Cloudflare, with EU-region cache rules; birth data passes in transit and is not stored there |
| Administration | From Ukraine, over SSH with a key. GDPR Chapter V counts that as a transfer, so the DPA covers it with the Standard Contractual Clauses |
Details and the reasoning: GDPR / EU residency.
Who processes it
Section titled “Who processes it”| Party | What it gets | Named in |
|---|---|---|
| Hetzner Online GmbH | everything we store, as the host | DPA section 4 |
| Cloudflare, Inc. | HTTP requests on their way to our server | DPA section 4 |
| AI providers | only the computed chart (signs, houses, aspects) on the AI endpoints; no birth date, time, coordinates, name or place | Privacy policy section 8 |
| Brevo | your account email, to send service mail | Privacy policy section 8 |
| Monobank, LiqPay | the account owner’s payment details; never birth data | Privacy policy section 8 |
The DPA lists only the first two because only they touch the data of your API requests. The rest process account data, where we are the controller rather than you.
How long we keep it
Section titled “How long we keep it”| Data | Kept |
|---|---|
| Request log (no request parameters) | 30 days |
PDF report files (/v1/reports/*), which hold what you sent for them | 24 hours, or the retain_days you set, up to 90; deletable sooner |
| AI audit log | 90 days |
| Daily usage counters | 365 days |
| Account | until you delete it; deletion can be undone for 30 days, then it is erased |
| Payment records | 1095 days, as Ukrainian tax law requires |
| Encrypted backups | rotate out within 90 days |
You delete the account yourself, in the dashboard or with DELETE /v1/me/account.
Source: Privacy policy section 5 and DPA sections 2 and 9.
How it is protected
Section titled “How it is protected”- TLS only; plain HTTP is redirected.
- Passwords are hashed with bcrypt.
- API keys have been stored only as a SHA-256 hash since 2026-10-15, so a key is shown once, when it is created. Lose it and you rotate it; nobody, us included, can read it back.
- IP addresses are stored as a salted SHA-256, never in the clear.
- The database listens on loopback only, with a separate account per consumer.
- Backups are encrypted with AES-256 before they leave the machine.
- A breach that affects your data is reported to you without undue delay.
Source: DPA sections 5 and 8.
Contract
Section titled “Contract”The Data Processing Agreement under GDPR Article 28 comes with any paid plan, from Indie. You read it, accept it with a button in the dashboard, and download a PDF that carries the acceptance record. No sales call and no countersigned paper needed: Article 28(9) accepts the electronic form.
Availability
Section titled “Availability”- Live state and 90 days of history: status.astroway.info, described on Status.
- Uptime commitments and credits by plan: SLA.
Contacts
Section titled “Contacts”- Security incidents: security@astroway.info
- DPA and legal: legal@astroway.info
- Your data and your rights: api@astroway.info