What is processed where, who can see it, when it is deleted. These three questions cannot be added to software afterwards; they shape the data model, the hosting choice and the access design from the beginning.
German corporate buyers ask before signing, and the accepted answer is not in the cloud. What is expected is being able to show which service runs in which region. In the architecture we build, processing happens in the Frankfurt region and hosting stays inside the EU. To be explicit: some providers we use are US-headquartered companies even when the region is European. So we do not claim to avoid US services.
If data has to leave the EU, that needs a separate basis on the contractual side and it differs by country. The consequence on our side is this: which data crosses which border has to be visible from the start, and where possible the design should avoid the transfer entirely. Which basis fits your case is a legal question and goes to partner law firms.
Most data leaks come not from exotic attacks but from setups where everyone can see everything. Deny-by-default permissions, role-based access and row-level restrictions are expensive to add later and cheap to build in. The database behind this site grants browser roles nothing at all; we apply the same rule in client projects.
No. What is described here is the software-side consequence of the general framework. Which basis fits your case, which contracts are needed and which notifications apply are legal questions and go to partner law firms. OzyCore does not provide legal advice.
In most cases yes, and it is usually the simplest answer. The difficulty is that some third-party tools move data to their own region, so when we design the architecture we review the tool list as well. If a tool has no EU region it is either replaced or never given that data.
Tell us which tools you use and where the data goes. A first pass usually produces a handful of concrete fixes.