Why infrastructure is crucial for a compliance tool
A compliance tool that checks other parties’ communications for legal compliance is itself subject to increased scrutiny. If the tool’s own servers are located in the US, the product can, in principle, function, but this creates a dilemma for European customers. The US Cloud Act allows US authorities to access data stored on servers belonging to US providers, regardless of their physical location. EU-US data transfer agreements such as the EU-US Data Privacy Framework do not fundamentally alter this situation.
For a tool that processes potentially sensitive communication data, internal analyses and customer information, this represents a structural risk. We therefore opted for a European core infrastructure right from the start.
Our fundamental position
The core application and primary product data of EmpCo Manager run on infrastructure in Germany and thus within the EU. We do not use any US cloud services to operate the platform: no AWS, no Microsoft Azure, no Google Cloud and no US CDNs. The AI-based evaluation of individual claims also takes place within the EU, using language models that we operate ourselves.
This is a deliberate decision: regardless of the EU–US data transfer agreement in force at any given time, we do not wish to be dependent on it. Political agreements change, as do legal interpretations, core infrastructure within the EU remains largely unaffected by such changes.
Our infrastructure, transparent
The EmpCo Manager runs on dedicated servers at Hetzner Online GmbH, a German data centre operator with sites in Germany and Finland. Hetzner is subject to German and European law, not the US Cloud Act. The language models used for claim analysis run on servers at Hetzner in Germany and at Scaleway SAS in France, likewise within the EU.
Server IP: 5.9.146.5
You can verify this yourself: a search on ipinfo.io or whois.com confirms Hetzner as the operator, based in Germany. Anyone wishing to verify independently where our core infrastructure is located can do so using public tools.
All scan results, findings, compliance reports and user data are stored in encrypted form on these servers in Germany. There is no replication in US data centres.
What happens to your data during the website scan
Crawling on EU infrastructure
When you scan a domain, EmpCo Manager crawls the publicly accessible pages of that domain. This crawling process runs on Hetzner’s infrastructure, so the page content does not leave the European legal jurisdiction during this process.
Encrypted storage
The crawled content is analysed and the scan results are stored in encrypted form in Germany. Only you and the team members you have invited have access to your scan data. Platform administrators have no access to your content data.
Deletion options
You can delete scan data at any time. Upon request, we will export your data and remove it from the live systems after a defined period. Backups are retained for 30 days; after this period, backups are also permanently deleted.
Quick question: Try it for yourself, experience our German infrastructure
You have now read about where your data is stored and how the scanning process works. See for yourself: start a scan of your domain and watch the analysis run on Hetzner servers in Germany.
Check your own website now, free of charge...
Free · No credit card · Results in 10-15 min.
Moving on to the question of how individual claims are evaluated:
Evaluation of individual claims: where it takes place and what is processed
Self-operated language models
For the evaluation of individual environmental claims, we use language models that we operate ourselves on servers at Hetzner (Germany) and Scaleway (France). No external AI provider is involved. The models recognise patterns in natural language text that purely rule-based systems often miss.
What is processed
For the assessment, the models process the wording of the respective environmental claim, for example ‘100% climate-neutral’, together with the surrounding publicly accessible text context of the page and a random technical ID. The text context is required so that the statement can be evaluated in its proper meaning. Neither your company nor the scanned domain can be derived from the technical ID.
What is not processed
The models receive no source URLs, no account or master data, no non-public customer data and no complete page content. We deliberately process only what is required to assess the respective statement.
No model training using your data
Claim texts and analysis results are not used to train any models, neither our own nor those of third parties.
Data Processing Agreement (DPA)
If you use EmpCo Manager in a business context, we will enter into a Data Processing Agreement with you in accordance with Article 28 of the GDPR. For Enterprise customers, we draw up bespoke Data Processing Agreements on request, tailored to internal compliance requirements.
GDPR-compliant, in concrete terms
“GDPR-compliant” is a claim that is often made but rarely specified. In concrete terms, this means the following for EmpCo Manager:
- Data minimisation (Article 5): We only collect data that is strictly necessary for the platform to function and for analysis.
- Storage limitation (Art. 5): Scan data is stored for as long as your account is active. Deletion is possible at any time upon request (Art. 17 GDPR).
- Encryption (Art. 32): Data transmission is encrypted (TLS 1.3).
- Right of access (Art. 15): You may request an export of your data at any time.
- Right to erasure (Art. 17): You may request the erasure of your data, without giving any reason.
Data controller and contact details
The data controller within the meaning of the GDPR is Papoo Software & Media GmbH. You can contact our Data Protection Officer at datenschutz@empcomanager.com. We usually respond to specific enquiries regarding data processing within 5 working days.
Conclusion: Infrastructure as a compliance decision
For a compliance tool, infrastructure is not merely a technical detail, but an integral part of the service. US cloud infrastructure inherently entails exposure to the Cloud Act, and thus a risk that European customers need not bear. Our decision to use Hetzner servers in Germany as our core infrastructure, to run the claim analysis on self-operated language models within the EU and to implement clear data deletion processes is not a marketing ploy, but a direct consequence of our product promise.
Frequently Asked Questions
Where are the servers physically located?
On Hetzner servers located in Germany. The IP address 5.9.146.5 can be verified via public Whois services.
Is my scan data used for training models?
No. Your data is not used to train any models, neither our own nor those of third parties.
Does the claim analysis rely on external AI services?
No. The language models run on servers that we operate within the EU, at Hetzner in Germany and Scaleway in France. No data is sent to external AI providers for the analysis.
What happens if I delete my account?
We will delete all your data from the live systems within 30 days. Backups will be overwritten after a further 30 days. You can export your data in advance, we provide your data in machine-readable JSON format.
Disclaimer
This article describes our technical infrastructure and internal policies. It does not constitute legal advice. For a legal assessment of your specific situation, we recommend consulting a solicitor specialising in data protection law.
