Skip to content
DefenceGate

Where the data runs

What DefenceGate runs where, as read on 18 October 2026. The site and its data are on servers in the EU. Some services we depend on are not: they are listed below, with what each one sees.

In the EU

  • Server: the website, the API, the database and the collection jobs

    Provider
    Hetzner Online GmbH
    Where
    Helsinki, Finland (the server’s address is registered to Hetzner in Helsinki)
    In the EU
    Yes

    One virtual server. There is no content delivery network or proxy in front of it: visitors connect to it directly.

  • Archive of source payloads, and database backups

    Provider
    Hetzner Online GmbH (a Storage Box)
    Where
    Germany (the box’s address is in Hetzner’s German range; we have not asked Hetzner for the data centre)
    In the EU
    Yes

    Backups made since 12 October 2026 are encrypted before they leave the server; the key is not on the server. Older plaintext dumps age out by 11 November 2026. Production writes the archive to the Storage Box only.

Not in the EU, or not assessed

  • Domain registration and name service (DNS)

    Provider
    Cloudflare, Inc.
    Where
    United States company; DNS answers come from its worldwide network
    In the EU
    No

    Cloudflare is the registrar and answers the question “what is the server’s address?”. It can see the address of the resolver that asks. It is not a proxy: pages and API calls do not pass through it.

  • Certificate for https

    Provider
    Let’s Encrypt (Internet Security Research Group)
    Where
    United States organisation
    In the EU
    No

    The server asks it for a certificate for our domain name and renews it. It never sees a page or a visitor. The certificate in use on 18 October 2026 was issued by Let’s Encrypt.

  • Source code, and the tests run on every change

    Provider
    GitHub (Microsoft)
    Where
    United States company
    In the EU
    No

    The code is in a public repository, which is the origin of the server’s copy of it. The tests there run on invented data, not on ours. No visitor data is in the repository.

  • Reading public call documents to find who may apply

    Provider
    OpenAI
    Where
    United States company
    In the EU
    No

    For funding calls whose rules are written in a PDF, the text of that public document is sent to OpenAI’s API with a fixed question. Each answer must quote the document, and a quote that is not found in the document is dropped. Sent: the text of public call documents (and of a topic’s published conditions) and our instructions. Not sent: visitor data, account data, profiles from the readiness check, or anything from the database other than the document. We ask that OpenAI does not store the request (the API’s store option is off). A monthly spending cap applies. This is the only language-model service we use.

  • Operator alerts

    Provider
    Telegram
    Where
    Not assessed
    In the EU
    Not assessed

    A short text goes to the operator’s chat when a collection job fails or a backup is late. The texts describe jobs and sources, not visitors. We have not assessed where Telegram processes messages.

What your browser loads

The pages load their scripts, styles and fonts from our own server. The fonts are copied into the site when it is built; a visitor’s browser does not contact Google Fonts. The site sets no tracking cookies and loads no analytics, advertising or social-media code. Its content security policy only allows requests to our own address. We count page views by page, day and kind of referrer without an identifier (see the privacy notice).

We checked the home page and a call page: the HTML names no resource from another host. A call page links to the source’s own website; that is a link you choose to follow.

At build time, on the server, the build tool downloads the fonts from Google and the code libraries from the npm registry. No visitor data is involved.

What this does not say

  • It does not say that no US company is in the path: the services above are US companies, and the list says which do what.
  • It does not say who can be compelled by which country’s law. A server in the EU run by an EU company is one fact; the law that applies to it is another, and we do not give legal advice.
  • Account sign-in by e-mail is not open. When it opens, the mail provider will be named in the privacy notice and here.
  • Where the answer is “not assessed”, we have not checked it.