Compliance & data residency
Where your data lives, the law it answers to, and who could be compelled to hand it over.
- Hosting location
- European Union (Paris, France region).
- Data residency
- Customer data is stored and processed within the EU.
- Infrastructure providers
- EU-based cloud infrastructure only. No US hyperscalers (AWS, Google Cloud, Azure) in the path.
- Company & jurisdiction
- Eighteen Zeros Limited, registered in England & Wales (company no. 16984763), 128 City Road, London EC1V 2NX. Operates under UK law.
- Data-protection regime
- UK GDPR and the EU GDPR.
- ICO registration
- Registered with the UK Information Commissioner's Office as a data controller, reference ZC158771. Searchable on the ICO public register.
- Sub-processors
- Scaleway (EU cloud infrastructure & object storage, Paris); QBoxmail (EU email, Italy); Hetzner (encrypted off-site backups, Germany); Scaleway Transactional Email (EU). The current list is published in our privacy policy and provided to customers on request.
- AI training
- We do not train AI models on customer data, and it is not part of our business model.
FAQ
- What is the US CLOUD Act, and does it reach my data?
- The US CLOUD Act (2018) lets US authorities compel any US-based company to hand over data in its control, regardless of the country where that data is physically stored. AWS, Google Cloud and Microsoft Azure are US companies, so data they host falls within its reach even when the servers sit in an EU data centre. Choosing a "region: EU" setting on a US hyperscaler does not change who can be compelled. Eighteen Zeros uses European infrastructure only: an EU-jurisdiction provider hosting in Paris, France, with no US provider anywhere in the path. There is no US-jurisdiction company holding your data to compel, so it is not exposed to the CLOUD Act through the infrastructure it runs on. That is the distinction an EU tenancy on AWS, Google or Microsoft cannot offer.
- Where is my data hosted?
- In the European Union. Your live services run in Paris, France; encrypted backups are held off-site within the EU. Email runs on our EU-based provider. Nothing is stored or processed outside the EU.
- Is Eighteen Zeros GDPR compliant?
- We operate under both UK GDPR and the EU GDPR. Every sub-processor we use is located in the EU or the UK — the current list is published above and in our privacy policy, and provided to customers on request.
- Can I leave and take my data with me?
- Yes. The entire stack is open source and built on open standards — IMAP for mail, CalDAV and CardDAV for calendars and contacts, standard formats for files. Your data is portable by design, so if you ever leave we help you export everything cleanly. There is no proprietary format holding you in.