Infrastructure
Last updated: 19 October 2026
This page sets out which services operate the infrastructure of MargenOptimierer, where they have their registered office, where they process your data and which legal systems they are subject to as a result. Below that, we describe in general terms which technical, organizational and contractual measures apply to your data, including with regard to access by government bodies from countries outside the European Union. All information comes from Annex 1 and Annex 2 of the data processing agreement.
Our own servers
We do not operate any servers of our own. The data centers are operated by the services in the table below, each under its own protective measures.
Services, registered office and place of processing
A service is subject to the law of the country in which it has its registered office and to the law of the countries in which it processes data. The legal systems column names these countries.
| Service and task | Registered office | Place of processing | Legal systems |
|---|---|---|---|
| Supabase Pte. Ltd., supported by Supabase, Inc. · Database, sign-in, data storage and backups | Singapore, Supabase, Inc. in the USA | Database and backups in Frankfurt am Main, Germany; access for support and operations from Singapore and the USA | Germany and European Union, Singapore, USA |
| Vercel Inc. · Running the application and delivering the website | USA | Compute region Frankfurt am Main, Germany; also processing in the USA and in other countries in which Vercel or its sub-processors operate | Germany and European Union, USA, other countries |
| Railway Corporation · Background processing, in particular synchronization with the marketplace accounts, working through jobs and sending emails | USA | Region Amsterdam, Netherlands; also processing in the USA, including operational logs, and under Railway's contract also in other countries outside the European Economic Area | Netherlands and European Union, USA, other countries |
| Hetzner Online GmbH · Server with a fixed address through which the connections to the marketplaces run; the encrypted connection passes through the server, and content and access credentials cannot be read there | Germany | Germany | Germany and European Union |
| Plus Five Five, Inc. (Resend) · Sending the application's emails | USA | USA | USA |
| Functional Software, Inc. (Sentry) · Error reports from the application and background processing; information about persons is removed before they are sent | USA | Frankfurt am Main, Germany | Germany and European Union, USA |
| Anthropic Ireland, Limited, with processing by Anthropic, PBC · AI-based tools for operations, maintenance, error analysis and support, and AI-based functions of the application; the data is not used to train models | Ireland, Anthropic, PBC in the USA | USA | Ireland and European Union, USA |
| Google Cloud EMEA Limited, with processing by Google LLC · Our email mailbox, for example for operational notifications and inquiries | Ireland, Google LLC in the USA | European Union, USA and other countries in which Google or its sub-processors operate facilities | Ireland and European Union, USA, other countries |
Basis for transfers to third countries
- Supabase · Standard contractual clauses of the European Commission
- Vercel · Adequacy decision of the European Commission on the EU–US Data Privacy Framework and standard contractual clauses of the European Commission
- Railway · Standard contractual clauses of the European Commission
- Hetzner · No transfer to third countries
- Resend · Adequacy decision of the European Commission on the EU–US Data Privacy Framework and standard contractual clauses of the European Commission
- Sentry · Adequacy decision of the European Commission on the EU–US Data Privacy Framework and standard contractual clauses of the European Commission
- Anthropic · Standard contractual clauses of the European Commission
- Google · Standard contractual clauses of the European Commission; Google LLC is also certified under the EU–US Data Privacy Framework
Measures for your data, including with regard to third countries
Described in general terms, these measures apply.
Contractual
- The standard contractual clauses of the European Commission apply with every service that processes data outside the European Union, and for Vercel, Resend and Sentry also the adequacy decision on the EU–US Data Privacy Framework.
- For work with AI-based tools, we use only the services in the table above, under their terms for business customers; the data is not used to train models.
Technical
- Database and backups are located in Frankfurt am Main. The database and backups are encrypted at rest by the database provider.
- Connections from the browser and to the marketplaces are transmitted in encrypted form. The connections to the marketplaces run through a dedicated server with a fixed address in Germany; content and access credentials cannot be read there.
- Access credentials for your marketplace accounts are stored encrypted in locked tables and can only be reached on the server side.
- Secret keys are never used in the browser or in any path that serves a user's request.
- Every table containing customer data is assigned to a company; the database itself refuses access to the data of other companies.
- Names, addresses, contact details and payment information of buyers, as well as shipment and return identifiers, are discarded when data is read in.
- Information about users and recognizable personal data is removed from error reports before they are sent.
Organizational
- At our end, only the owner and persons the owner has authorized and bound to confidentiality have access to your data, in each case only to the extent necessary.
- We have support access only if you grant it, and only for a limited time; changes to marketplace accounts and actions on members and invitations are logged.
- Every change sent to a marketplace account is logged with its originator, time and result, and our actions as operator are recorded in a separate log.