Security, data and GDPR
Does any data leave the European Union?
Production data and backups remain in the EEA. Only network traffic (Cloudflare) and the delivery of push notifications may pass outside the EEA, with safeguards provided for by the GDPR.
These transfers are governed by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses. The content of push notifications is minimal and end-to-end encrypted.
Reference : Annex 1 §6, Annex 2 B of the terms and conditions