1. Deployment Regions
exdata stores core production customer account data, uploaded documents, previews, extraction data, webhooks, and operational records in Hetzner infrastructure and object storage located in Falkenstein, Germany.
Hetzner Cloud server backups remain in the same Falkenstein location as their source servers. Database backups for the staging and production environments currently operated by exdata are also stored in Amazon S3 in Ireland (AWS region eu-west-1). Any customer-specific hosting or backup arrangement must be expressly agreed in the applicable order form or onboarding record before regulated or residency-bound documents are uploaded.
2. Customer Data
Customer data includes uploaded files, extracted text, normalized fields, previews, thumbnails, account settings, API token metadata, webhook configuration, support context, billing references, and operational logs.
Retention settings can remove source files, previews, extracted metadata, and operational logs after configured periods. Billing, audit, security, backup, and legal records may have different retention periods.
3. Third-Party Providers And Transfers
Payments, email delivery, monitoring, registration security, infrastructure, and AI-assisted extraction may involve third-party providers and subprocessors listed on the Subprocessor List. Those providers may process data in regions governed by their own service terms and data processing commitments.
The standard Hetzner infrastructure and object-storage location is Falkenstein, Germany. Locations for other listed providers follow the current configuration and provider terms summarized on the Subprocessor List.
Where a transfer mechanism is required, exdata uses appropriate safeguards such as standard contractual clauses, adequacy decisions, subprocessor transfer terms, and supplementary measures where applicable.
4. Customer Commitments
If a customer requires a specific hosting region, backup region, transfer restriction, or subprocessor restriction, that requirement must be confirmed in the applicable order form or onboarding record. Customers should not upload documents that are subject to unconfirmed residency requirements.