The servers
The application, the databases, email, search and video calls. Everything runs on servers we rent from Contabo and administer ourselves.
- Clients, invoices, appointments
- Email and team chat
- Audit log
Where your data lives and who can touch it
Your data is hosted in the European Union, kept separate from other companies’ data. This page tells you where it is stored and what you can ask for.
Munich and Paris Backup every night Full export at any time
Two cities, both in the European Union
The application and its databases run in Munich. The files you upload and the backup copies are stored in Paris.
The files
The documents, photos and attachments you upload, on Scaleway’s object storage, along with the backup copy of every database.
- Team and personal files
- Expense receipts
- Encrypted backups
What protects your account
These measures are in place today. The full security policy is sent on request.
Encrypted connections everywhere
HTTPS with TLS 1.3 by default; older versions are refused.
Two-factor authentication
A one-time code on top of the password, or a passkey on your phone.
Attempts blocked
After five wrong passwords, the account locks for fifteen minutes.
Role-based permissions
Each person opens only what their role allows, right down to the AI assistant.
Access removed at once
Removing a member invalidates their current sessions, without waiting for them to expire.
Audit log
Changes to roles and invitations are kept for one year, ten years on Enterprise.
Tested backups
Every night, encrypted and copied off the server. A restore is tested every week.
One company, one workspace
Isolation is checked on every request: no customer’s data can be read from another.
Who else processes your data
The full list, with the country and the safeguard when data leaves the European Union. We let you know before adding one.
7 of 7
ProviderWhat it doesWhereSafeguard
ContaboServers, applications and databasesMunich, GermanyIn the EU
ScalewayStorage for files and backupsParis, FranceIn the EU
HostingerDomain names bought through PuwapiLithuania and CyprusIn the EU
deSECDNS for the platform’s domains, with no data about your clientsGermanyIn the EU
StripePayments and billing. Card numbers never pass through our serversIreland, with access from the United StatesStandard contractual clauses
AnthropicAI features, only if you use themUnited StatesStandard contractual clauses, no training on your data
Google, Apple, MicrosoftSign-in with their account, only if you choose itIreland, with access from the United StatesStandard contractual clauses or the EU-US Data Privacy Framework
Copies of the safeguards on request at contact@puwapi.com. Convex, search, video calls and the mail server run on our own servers: they are not subprocessors.
AI, only if you want it
What you write to the assistant is processed by Anthropic, in the United States. It is the only content you write that leaves the European Union.
- OptionalA company that does not use the assistant sends nothing to the AI provider.
- Never used to train a modelThe provider commits to this by contract for everything that goes through its API.
- Nothing is kept for mail and chatA thread summary is shown once, then deleted.
- The Claude connector is off by defaultThe administrator opens it for reading or writing, and can close it again at any time.
Your rights, and how to exercise them
An email to contact@puwapi.com is enough, with no particular wording.
Access, Article 15
Know what we hold
Just write, for example: “What data do you hold about me?”
Yourself
All your data is visible in your workspace.
By writing to us
On request, we send you a copy with the purposes, the recipients and the retention periods.
Reply within one month, free of charge.
The documents that are authoritative
What people ask us about data
What happens to my account if I leave?
First, you export what you want to keep, as CSV or JSON. Then you delete your account from your settings; your password is enough to confirm.
Does Puwapi read my data?
We do not open your workspace without a reason. Administrative access to the platform is personal and key-protected, and its sensitive actions are logged.
What happens in the event of a data breach?
A written procedure provides for assessing the incident, notifying the CNIL, the French data protection authority, within 72 hours where required, and informing the people concerned when the risk is high.
Can I store health data in it?
No. The hosting is not certified for health data. Healthcare practices keep their patient records in their specialist software.
A question about your data?
Write to us. A member of the team will reply and send you the security policy. The data processing agreement (DPA) can be read at any time at puwapi.com/dpa.
Write to contact@puwapi.com