Data privacy & performance: why our architecture is 100% GDPR compliant

Privacy isn't an afterthought – it's architecture

Many companies treat the GDPR like a checklist to work through after launch: add a cookie banner, generate a privacy policy, done. In practice, however, the question of legal compliance is decided far earlier – at the moment the technical architecture is defined.

Because a website isn't a single system. It's the interplay of three layers: delivery, processing, and storage. Throw all three onto one server and you lose control over where personal data actually resides. We take a different route – and deliberately separate these layers.

The two-pillar principle: separating delivery from data storage

Our architecture draws a consistent line between what visitors see and what gets stored.

Pillar 1: the frontend on Vercel

The Next.js frontend runs on Vercel. That's where pages are rendered, static content is cached, and requests are routed to the nearest network node. The result is millisecond load times and excellent Core Web Vitals. The crucial part: in our architecture, Vercel is purely a delivery and rendering layer – not a data store.

Pillar 2: backend and database on Hetzner in Germany

We operate the Laravel API and the PostgreSQL database on dedicated Hetzner cloud servers in Germany – at the data center locations Frankfurt am Main and Falkenstein. Everything that is stored permanently lives here: form submissions, customer records, uploads, logs.

The separation is the actual point: we take our speed from a global edge network. Personal data stays in Germany.

Why Hetzner stands for digital sovereignty

Choosing the backend host is the single most important privacy decision in the entire project – because this is where the data really sits. Hetzner meets every criterion that matters for European companies:

• German locations only: All database content and form submissions physically reside in Frankfurt am Main or Falkenstein – no third-country transfer for data storage.
• ISO 27001-certified data centers: Access control, redundancy, and operational security are audited against an internationally recognized standard.
• German company, German law: As a German provider, Hetzner is directly subject to the GDPR and the German Federal Data Protection Act – no detour via adequacy decisions.
• Data processing agreement under Art. 28 GDPR: The DPA is available as standard and cleanly documents the processing for your accountability obligations.
• Full control over the stack: We define encryption, backup strategy, access rights, and retention periods – not an opaque managed service.

And what about Vercel? A US provider in a GDPR architecture

This is the question CTOs rightly ask first. The answer isn't "Vercel is unproblematic" but rather: it depends on what role the platform plays in the architecture. Four factors are decisive.

1. Data Privacy Framework and Standard Contractual Clauses

Vercel is certified under the EU-U.S. Data Privacy Framework. On top of that, Standard Contractual Clauses (SCCs) and a data processing agreement (DPA) apply. This establishes a solid legal basis under Chapter V of the GDPR for the technically unavoidable processing steps, such as connection data.

2. Region pinning to Frankfurt (fra1)

We explicitly configure serverless functions and edge execution to the fra1 – Frankfurt am Main region. Dynamic requests are therefore not processed somewhere around the globe but deliberately within Germany. This isn't default behavior but a conscious configuration decision we make in every project.

3. Edge network with European nodes

Static assets and cached pages – images, fonts, JavaScript, HTML – are served from CDN nodes in Europe, typically Frankfurt or Hamburg for German visitors. This minimizes latency while keeping the data path short and inside the EU.

4. No persistence of personal data on Vercel

The most important point: nothing is stored permanently on Vercel. When a user submits a contact form, the request is passed straight through a TLS-encrypted connection to our Laravel API on the German Hetzner server. Vercel only sees the data as transient transport – comparable to a network router, not a filing cabinet.

We don't "spread" personal data across the cloud. It has exactly one place of storage – and that place is in Germany.

Technical security in detail

Legal compliance without technical hardening remains theory. That's why the following measures are standard for us:

• End-to-end TLS 1.3 encryption: From the browser through the Vercel edge to the Hetzner API, every connection is encrypted to current standards – including internal server-to-server communication.
• Data minimization instead of cookie bloat: Traditional CMS and plugin setups often drag along dozens of third-party scripts that quietly send data to external providers. Our stack loads only what we deliberately integrated – no uncontrolled data outflow.
• Self-hosted assets: We serve fonts and scripts from our own origin instead of pulling them from external services, removing one of the most common sources of legal warnings in recent years.
• Complete DPA chain: Data processing agreements are in place with both providers – Hetzner and Vercel – so your record of processing activities can be kept without gaps.
• Minimized attack surface: No publicly reachable admin login, no third-party plugin dependencies, clearly defined API endpoints instead of directly exposed database access.

The bottom line for businesses

Privacy and performance are often framed as opposites: either fast and global, or legally safe and slow. That trade-off is an artifact of outdated architectures. Separate delivery from data storage cleanly and you get both.

• What visitors experience: A globally cached, lightning-fast frontend served from the nearest European node.
• Where your data lives: Exclusively on ISO 27001-certified servers in Frankfurt am Main and Falkenstein.
• What you hold in your hands: Data processing agreements, a documented data flow, and an architecture that withstands scrutiny from a supervisory authority or your legal department.

Speed is a competitive advantage. Privacy is a prerequisite. A clean architecture delivers both – without compromising on either side.

If you'd like to know where personal data is actually processed in your current setup, let's look at it together. More often than not, the risk isn't in the hosting but in embedded third-party scripts nobody remembers anymore.