EU jurisdiction, not just an EU region

Where your servers are isn't the whole story. Who owns them decides which laws apply to your data.

An example

acme-shop lands its first big customer. Then the security questionnaire arrives.

Larger customers, and public-sector ones especially, ask the same questions before they sign: where their data lives, who can get at it, and who else touches it.

Hosted in a US cloud's EU region, the first answer is easy. The second one isn't: the provider is a US company, so US data-access laws still apply to it. On Apply.Build, the same question has a short answer.

Supplier security questionnaire

  1. 1. Where is our data stored?

    US cloud, EU region

    In an EU region

    Apply.Build

    In the EU, in Finland

  2. 2. Is our data out of reach of US warrants?

    US cloud, EU region

    No. The provider is a US company, so it must hand over data on a US warrant, even data stored in the EU, and can be barred from telling you.

    Apply.Build

    Yes. Codebite Oy is an EU company. US data-access laws such as the CLOUD Act don't apply to it.

  3. 3. Who are your sub-processors?

    US cloud, EU region

    One list per service in your stack: hosting, firewall, scanning.

    Apply.Build

    One public list, with notice before any change.

  4. 4. Can you sign a data processing agreement?

    US cloud, EU region

    Usually, one per provider.

    Apply.Build

    Yes, available on request.

How your data actually flows

Every place your data goes, including the US services involved.

Visitors

Your users

GitHub (US)

Source code, pulled to build

EU · run by Codebite Oy · EU law

Firewall (WAF)

Filters attacks

Your app

In its own micro-VM

PostgreSQL

Your database

Logs, metrics

And backups

Billing only

Stripe

Payments, EU and US. No app data.

Everything inside the EU box is run by Codebite Oy. Dashed boxes are services outside Apply.Build.

Where data goes, specifically

Your running app, database, logs, metrics, backups
Where: Finland
Operated by: Codebite Oy, on dedicated bare-metal servers
Your source code
Where: Your GitHub repository. We pull it to build in Finland.
Operated by: You, and GitHub
Payment details
Where: EU and US. No application data ever passes through it.
Operated by: Stripe

Our full sub-processor list is public, and we tell you before adding or replacing one. See the sub-processor list

What EU jurisdiction gives you

  • The platform, your app and its data stay under EU law and GDPR.
  • A data processing agreement, available on request.
  • One public sub-processor list, with notice before changes.

What it doesn't do

  • It doesn't make your own app GDPR-compliant. For personal data inside your app, you're the controller and Apply.Build is the processor.
  • Your source code lives on GitHub and payments go through Stripe, both US companies. No application data passes through Stripe.

Deploy in Europe today

Start with a free tier. Every plan runs under EU jurisdiction.

Deploy your first app free