Where your data lives

This service promises that customer data it stores stays inside the European Union. This page says exactly what that covers and what it does not. The providers are US companies; the promise is about where data is stored, not who owns the providers.

Pinned to the EU

Tenant state. Plans, daily usage counters, watchlist indexes, and the cache of API key checks live in a Durable Object created through the eu jurisdiction. Cloudflare runs and stores such objects only in EU data centres.
Watchlists. Every tender and filings watchlist is its own Durable Object in the eu jurisdiction, including the notices and filings it has found.
Accounts, API keys and billing records. Stored in Postgres in Nuremberg, Germany (Hetzner Online), on the server that also runs this website. API keys are stored only as hashes.
The tender, award and company copy. Public TED notices, award winners and the filings index are copied into the same Nuremberg database. Tender, award and company searches run against this copy.
Website server. This website runs on the same server in Nuremberg, Germany.
Map tiles and sheet metadata. The R2 bucket is created with the eu jurisdiction. Sheet metadata lives in eu Durable Objects.

Not pinned, by design or by platform limits

Requests. The Worker that answers MCP requests runs in the data centre closest to the caller and holds no state. Cloudflare Regional Services for the EU can also keep request processing inside the EU.
Query cache. Searches reach the database through Cloudflare Hyperdrive, which may cache query results for up to 60 seconds in Cloudflare's network.
Durable Object ids. Cloudflare logs object ids outside the jurisdiction for billing and debugging. Ids are derived by hashing internal names and carry no customer data.
Workers Logs. Sampled request logs, stored by Cloudflare's observability platform, are not jurisdiction-pinned. They hold request metadata, such as the URL, and messages this service logs. They do not hold request bodies, so tool arguments and results are not logged.
Live fallback. When the database is unreachable, tender searches go directly to the public TED service at api.ted.europa.eu, and your search terms are sent there.
Filings tools. Filings searches, filing lookups and figures, and filings watchlists call the public filings.xbrl.org service directly. Your search terms, the filings you ask about and your watchlist filters are sent there. Annual report search on this website reads the copied index instead.
Public data sources. Our scheduled jobs read from TED, the filings.xbrl.org index of annual reports, and the GLEIF LEI register. These jobs send no customer data.
Stripe. Payment details are handled by Stripe and never touch this service.

Sub-processors

Provider	Purpose	Where data is stored
Cloudflare	MCP server, Durable Objects, R2, Hyperdrive, logs	Durable Objects and R2 in the EU; logs and cache as above
Hetzner Online	Website server and Postgres database	Nuremberg, Germany
Stripe	Payments and usage billing	Stripe's own data locations
Email provider (to be chosen)	Daily digest emails	To be confirmed with the provider

How to check

Every storage object checks when it starts that it was created in the EU jurisdiction, and refuses to run otherwise. AI agents connected with your key can ask the service which jurisdiction holds your account.