This page shows where our servers run, which suppliers process data for us, and what we do to protect it. The supplier list is built from the systems that are actually running — not written by hand.
In short
- Our own servers run in Stockholm (Fly.io, region arn) — measured on every running service.
- Our default AI is Mistral in France, not an American model.
- We tell it as it is. Several of our suppliers are American companies. The list below shows where the instance we use actually runs — and where we are moving to the EU.
Security
One shared set of controls for all our products, inspired by ISO 27001. We only say «in place» when it is true today.
| Control | Status | What it means | How we know |
|---|
| Hosting in the EU | In place | All our own services run on servers in Stockholm. | Read from every running service, 27 September 2026. |
| Encryption | In place | All traffic is encrypted (HTTPS/TLS). Disks and databases are encrypted by the hosting provider. | HTTPS on all our domains; encrypted storage is the default at Fly.io and Supabase. |
| Two-factor sign-in | In place | Single sign-in (Broberg ID) with passkeys and two-factor. Being rolled out to all products. | Built into Broberg ID. |
| Incident response plan | In place | A written plan. If we process data on your behalf, you hear from us within 24 hours. The Danish Data Protection Agency is notified within 72 hours where we are the controller. | Plan approved by management, 27 September 2026. |
| Backups | In progress | Daily copies, kept for 30 days. We are moving all copies to storage locked to the EU and introducing a monthly automated test that a copy can be restored. | 30-day retention read from every data disk, 27 September 2026. |
Documents
Found a security issue?
Write to security@broberg.ai. We reply within one business day. Machine-readable contact: /.well-known/security.txt.
Web House ApS · Danish company reg. (CVR) 21221198 · Riberhusvej 9, 9492 Blokhus, Denmark
Suppliers who process data for us
Sub-processors in production, and where the instance we use runs. «Measured» means we read it from our own setup; the rest comes from the supplier's own pages. Every supplier outside the EU is covered by an EU-approved transfer mechanism. A new supplier is listed here at least 30 days before we start using it.
Data in the EU (6)
| Supplier | Used for | Where data lives | Company | Transfer |
|---|
| Fly.io | Hosting of our services | Stockholm · measured | USA | EU-US Data Privacy Framework |
| GatewayAPI | SMS codes at sign-in | Denmark, Germany, Finland | Denmark | Within the EU |
| Microsoft Azure | Speech-to-text and text-to-speech | Western Europe | USA | EU-US Data Privacy Framework |
| Mistral AI | AI language models (our default) | France | France | Within the EU |
| Simply.com | Domains | Denmark | Denmark | Within the EU |
| Supabase | Database and sign-in | Stockholm · measured | USA | EU standard contractual clauses |
Partly in the EU (4)
| Supplier | Used for | Where data lives | Company | Transfer |
|---|
| Cloudflare | Domains, DNS, file storage and spam protection | File storage: EU · DNS and network: global · measured | USA | Data Privacy Framework + standard clauses |
| Resend | Sending email | Sent from Ireland · mail metadata in the US | USA | Data Privacy Framework + standard clauses |
| Stripe | Payments | Contract in Ireland · may be processed globally | USA | Data Privacy Framework + standard clauses |
| Tigris | File storage and backups | Moving to the EU (in progress) · measured | USA | EU standard contractual clauses |
Outside the EU (10)
| Supplier | Used for | Where data lives | Company | Transfer |
|---|
| Anthropic | AI models | United States | USA | EU standard contractual clauses |
| ElevenLabs | Text-to-speech (podcast) | United States | USA | Data Privacy Framework + standard clauses |
| fal.ai | Image generation | United States | USA | EU standard contractual clauses |
| GitHub | Source code and automated deployment | United States | USA | Data Privacy Framework + standard clauses |
| Google Firebase | Push notifications to apps | Global | USA | Data Privacy Framework + standard clauses |
| Google Gemini | AI models (fallback) | United States | USA | EU-US Data Privacy Framework |
| Google Workspace | Email, calendar and sign-in | Global | USA | Data Privacy Framework + standard clauses |
| OpenAI | AI models | United States | USA | EU standard contractual clauses |
| OpenRouter | Access to AI models, incl. images (Recraft) | United States | USA | EU standard contractual clauses |
| Vimeo | Video | United States | USA | Data Privacy Framework + standard clauses |
List last changed 27 September 2026.
