— GDPR (EU) 2016/679 · EU Data Residency · SOC 2 Type II

GDPR Compliance

Obtura is built from the ground up as a GDPR-first platform. As a Romanian company operating within the European Union, GDPR compliance is not a checkbox for us — it is a core architectural and operational principle. This page explains how we protect your data and support your own GDPR obligations.

EU Data Residency

100% of customer data stored in EU data centers (Frankfurt & Amsterdam). Data never leaves the EEA.

SOC 2 Type II

Infrastructure certified to SOC 2 Type II standards, audited annually by independent third parties.

DPA Included

GDPR-compliant Data Processing Agreement included with all plans. Available upon request.

EU Data Residency

All customer data is stored exclusively within European Union territory. Your data never leaves the EEA.

Obtura operates its entire infrastructure within EU-based data centers. Our primary region is Frankfurt, Germany (eu-central-1), with failover capacity in Amsterdam, Netherlands (eu-west-1). We do not route, process, or replicate customer data outside the European Economic Area.

This matters because many competing DevOps platforms are US-headquartered and operate under US law — including the CLOUD Act — which may require them to disclose your data to US government agencies regardless of where the data is stored. As a fully European company, Obtura is not subject to US data access laws.

Primary RegionFrankfurt, Germany (EU)
Failover RegionAmsterdam, Netherlands (EU)
BackupsEncrypted, stored in EU only
CDN Edge NodesEU PoPs only for EU customers
Data SovereigntyRomanian & EU law exclusively
US CLOUD ActNot applicable — EU company

Data Processing Agreement (DPA)

Under GDPR, when you use Obtura to deploy applications that process personal data of your end users, you are the data controller and Obtura acts as a data processor. This requires a Data Processing Agreement (DPA) between us — as mandated by GDPR Article 28.

Our standard DPA:

  • Is incorporated by reference into our Terms of Service for all customers.
  • Covers Obtura's obligations as a data processor, including security measures, sub-processor management, breach notification, and deletion obligations.
  • Includes Standard Contractual Clauses (SCCs) for any data that may be processed by sub-processors outside the EEA.
  • Is provided as a standalone executed document upon request for customers who require it for compliance or audit purposes.

To request a signed DPA, contact dpo@obtura.dev.

Your Rights Under GDPR

GDPR grants individuals significant rights over their personal data. As a data subject, you can exercise these rights with respect to the personal data Obtura holds about you as a customer.

Right of Access (Art. 15)

Request a complete export of your account data via the dashboard under Settings → Privacy, or email alexserbwork@gmail.com.

Right to Rectification (Art. 16)

Update most account data directly in Settings. For corrections to billing or other records, email alexserbwork@gmail.com.

Right to Erasure (Art. 17)

Delete your account from Settings → Account → Delete Account. Full data deletion within 30 days (billing records retained 7 years per law).

Right to Portability (Art. 20)

Export all your account data and deployment configurations in JSON/CSV format from Settings → Privacy → Export Data.

Right to Restriction (Art. 18)

Request restriction of processing in specific circumstances. Contact dpo@obtura.dev with details of your request.

Right to Object (Art. 21)

Opt out of marketing at any time via email preferences. Object to legitimate-interest processing by contacting dpo@obtura.dev.

Right to Withdraw Consent

Withdraw consent for analytics cookies via the cookie banner. Withdraw marketing consent via email unsubscribe or account settings.

Right to Complain

Lodge a complaint with ANSPDCP (Romania) at dataprotection.ro or with your local EU supervisory authority.

We respond to all rights requests within 30 days. Identity verification is required. There is no charge for exercising your rights.

Technical & Organizational Security Measures

GDPR Article 32 requires data controllers and processors to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Here is what we have in place:

Encryption

256-bit AES encryption for all data at rest
TLS 1.3 for all data in transit (TLS 1.2 minimum enforced)
Encrypted database backups with separate key management
End-to-end encrypted secrets management (environment variables)

Access Controls

Role-based access control (RBAC) with principle of least privilege
Multi-factor authentication (MFA) required for all Obtura staff
Privileged access management (PAM) for infrastructure access
Access reviews conducted quarterly
Zero-trust network architecture

Infrastructure & Certifications

SOC 2 Type II certified infrastructure
ISO 27001 aligned security management (certification in progress)
Regular third-party penetration testing (annual minimum)
Automated vulnerability scanning (continuous)
DDoS protection and Web Application Firewall (WAF)

Operational Security

Documented incident response plan
72-hour breach notification procedure (GDPR Art. 33 compliant)
Employee security awareness training (annual)
Background checks for staff with data access
Segregation of duties for sensitive operations

Business Continuity

Automated backups with tested restore procedures
Multi-region disaster recovery capability
Recovery Time Objective (RTO): < 4 hours
Recovery Point Objective (RPO): < 1 hour

Sub-Processor Transparency

GDPR requires that we inform you of the sub-processors we engage to provide our services. We maintain strict contractual controls over all sub-processors and ensure they operate in compliance with GDPR.

Categories of sub-processors we use:

CategoryLocationSafeguard
Cloud Infrastructure (compute/storage)EU (Germany, Netherlands)EU-based, contractual
Payment ProcessingEU / EEASCCs + adequacy decision
Transactional Email DeliveryEU preferred / SCCs where outsideSCCs + TOMs
Customer Support PlatformEUContractual + EU data residency
Application Error MonitoringEUEU hosted, contractual

We will notify customers of any material changes to our sub-processor list at least 30 days in advance. The complete, up-to-date sub-processor list with named entities is available upon request at dpo@obtura.dev.

Data Breach Notification

In the event of a personal data breach, Obtura follows a strict incident response and notification procedure in compliance with GDPR Articles 33 and 34:

< 1 hour
Internal detection & triage

Security team assesses severity and scope of the incident.

< 24 hours
Customer notification

Affected customers notified with available details, even if investigation is ongoing.

< 72 hours
Authority notification

ANSPDCP (supervisory authority) notified as required by GDPR Art. 33.

Breach notifications to customers will include: the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed. We maintain a breach register in accordance with GDPR Article 33(5).

Data Protection Officer

Obtura has appointed a Data Protection Officer (DPO) as required under GDPR Article 37. Our DPO is responsible for overseeing compliance with GDPR, advising on data protection obligations, and acting as the point of contact for supervisory authorities and data subjects.

Data Protection Officer

Scope:
GDPR rights requests, DPA inquiries, regulatory matters
Response:
Within 5 business days

Supervisory Authority

Name:
ANSPDCP
Right to complain:
Available to all EU residents

How Obtura Helps You Stay GDPR Compliant

When you use Obtura to deploy applications that process your own customers' personal data, you become a data controller. Obtura helps you meet your own GDPR obligations:

DPA on Request

Signed Data Processing Agreement available instantly, suitable for your own GDPR documentation.

EU-Only Data Flows

Guarantee to your customers that their data is processed exclusively in the EU.

Data Export Tools

Built-in tools to export application data and logs to support your data subject access requests.

Audit Logs

Complete audit trail of all platform actions to support your accountability obligations.

Environment Isolation

Strict isolation between deployments to prevent cross-customer data leakage.

Encryption by Default

All data encrypted at rest and in transit — no configuration required from you.

Secrets Management

Encrypted environment variables and secrets vault — no plaintext credentials stored.

Access Controls

Granular RBAC so only authorized team members can access production data.