Who runs your site,
and where
Sovereignty depends on who owns the servers, the CDN and the company you sign with. Below is every provider your site goes through, and where each one is based.
The stack, layer by layer
Each company below is under a data processing agreement and processes data only to provide its part of the service.
| layer | provider | company based in | data location |
|---|---|---|---|
| Builds, containers running your site | Scaleway | France | Paris (fr-par) |
Shared cache ('use cache', pages) | Redis, self-hosted on Scaleway | France | Paris |
| Logs and observability | ClickHouse, self-hosted on Scaleway | France | Paris |
| Database and backups | Scaleway | France | Paris |
| CDN, static asset storage, TLS certificates | bunny.net (BunnyWay d.o.o.) | Slovenia | EU, edge servers worldwide |
| Email: sign-in codes, invitations, alerts | Brevo (Sendinblue SAS) | France | EU |
| Payments | Mollie B.V. | Netherlands | EU |
| Your repositories | The git host you choose | Your choice | Your choice |
The full, binding list is on the subprocessors page. We announce changes there 30 days in advance.
Two things to know
GitHub is a US company
If you connect GitHub, Tramontane uses it to read your repositories, receive push notifications, and post deployment statuses and preview links on pull requests. Builds, hosting and logs run on European infrastructure. If you want no US company at all, deploy from GitLab, Codeberg, or your own Forgejo or Gitea. Sign-in is by email, so you never need a GitHub account.
The CDN reaches beyond Europe
bunny.net has edge servers worldwide, so visitors far from Europe get cached files from a server near them. The company running the CDN is European. Your origin, cache, logs and storage stay in the EU.
Each site is isolated
Sites run on shared servers, and each one has its own credentials.
- cacheEach site has its own Redis user, which can only read and write its own keys.
- assetsEach site has its own storage zone, and its build gets only that zone's password.
- cdn purgesEach site gets a token for its own hosts. Only our purge service holds the CDN account key.
- logsLogs are kept for 30 days. Request lines store the path without the query string, which can hold secrets. Visitor IPs in CDN logs are anonymized by bunny.net.
- backupsNightly, in a private bucket in Paris, kept for 14 days.
- gdprExport your account as JSON, or delete it with its projects, from settings.