--- title: "Trust & Compliance — GDPR, Data Residency, Security" url: "/trust" canonical_url: "https://crunchjunkie.io/trust" markdown_url: "https://crunchjunkie.io/trust.md" language: "en" type: "page" summary: "Where your data lives (EU-resident, Frankfurt), our sub-processors, TOMs and GDPR posture — everything a vendor-security review needs, published." site: "CrunchJunkie" llms_txt: "https://crunchjunkie.io/llms.txt" --- # Trust & Compliance — GDPR, Data Residency, Security Source: https://crunchjunkie.io/trust Trust & Compliance # Built for your vendor-security review CrunchJunkie is built by a German company (Tiki-Taka Media GmbH) for the agencies and in-house teams who hold this data. Here is exactly where your data lives, who processes it, and the measures that protect it — everything an ISO-certified buyer needs to sign us off. ## Data residency Application compute Frankfurt (fra1) EU Vercel — EU region File storage Frankfurt (fra1) EU Vercel Blob — EU region Database Frankfurt (eu-central-1) EU Neon — EU region Application compute, file storage and the database all run in the EU (Frankfurt). As a US-incorporated host, Vercel may be subject to the US CLOUD Act; for AI processing fully within your own jurisdiction, use your own AI key (BYOK), and your prompts are processed by your own provider account. Customers can view and export a live **Data Location & Sub-processor Report** for their own workspace under Settings → Data & residency. ## Sub-processors We have Data Processing Agreements (Art. 28 GDPR) with every sub-processor that handles personal data on our behalf. AI providers are engaged only when you enable Managed AI or the feature that uses them. Sub-processor Purpose Region Transfer mechanism Vercel Vercel Inc. (USA) [DPA →](https://vercel.com/legal/dpa) Application hosting, CDN, serverless function execution (compute), and file/object storage Frankfurt (fra1), EU EU–US Data Privacy Framework + Standard Contractual Clauses Neon Neon Inc. (USA) [DPA →](https://neon.tech/dpa) Managed PostgreSQL database (all application data at rest) Frankfurt (eu-central-1), EU Processed in the EU — no third-country transfer Upstash Upstash, Inc. (USA) [DPA →](https://upstash.com/static/trust/dpa.pdf) Shared rate-limit counters for API and sign-in endpoints (request counts keyed by IP address) · Retention: Counters expire automatically after 1–15 minutes Frankfurt (eu-central-1), EU Standard Contractual Clauses (+ Transfer Impact Assessment) Stripe Stripe, Inc. (USA) [DPA →](https://stripe.com/legal/dpa) Payment processing & subscription management United States EU–US Data Privacy Framework + Standard Contractual Clauses Resend Resend Inc. (USA) [DPA →](https://resend.com/legal/dpa) Transactional email delivery (password resets, report & alert emails) United States EU–US Data Privacy Framework + Standard Contractual Clauses SerpAPI SerpAPI, LLC (USA) Reads Google AI Overviews, Google AI Mode & Microsoft Copilot for visibility scans United States No transfer mechanism published by the vendor — do not send personal data Tavily Tavily (USA) Supplementary web-search retrieval in research & content-brief features United States No transfer mechanism published by the vendor — do not send personal data WorkOS(opt-in) WorkOS, Inc. (USA) [DPA →](https://workos.com/legal/dpa) OAuth authorization server for the MCP connector (issues the access tokens AI assistants use to call CrunchJunkie on a user's behalf) United States Standard Contractual Clauses (+ Transfer Impact Assessment) OpenAI OpenAI, L.L.C. (USA) [DPA →](https://openai.com/policies/data-processing-addendum/) AI-visibility scans (ChatGPT) and CrunchJunkie AI features · Retention: 30-day default; Zero-Data-Retention available United States (EU in-region processing available via EU Project) EU–US Data Privacy Framework + Standard Contractual Clauses Anthropic (Claude) Anthropic, PBC (USA) [DPA →](https://www.anthropic.com/legal/commercial-terms) CrunchJunkie AI features (report summaries, assistant), Claude visibility scans, and — for every workspace — reading each AI-visibility answer, the AI-visibility analyses and GEO audit insights · Retention: 7-day default; Zero-Data-Retention available (enterprise) United States Standard Contractual Clauses (+ Transfer Impact Assessment) Google (Gemini) Google LLC (USA) [DPA →](https://cloud.google.com/terms/data-processing-addendum) Gemini visibility scans and CrunchJunkie AI features · Retention: Not used to train models on paid API/Vertex United States (EU regions available via Vertex AI) EU–US Data Privacy Framework + Standard Contractual Clauses Perplexity Perplexity AI, Inc. (USA) [DPA →](https://www.perplexity.ai/hub/legal/dpa) Perplexity visibility scans United States Standard Contractual Clauses (+ Transfer Impact Assessment) Grok (xAI) X.AI LLC (USA) [DPA →](https://x.ai/legal/data-processing-addendum) Grok visibility scans · Retention: Deleted within ~30 days of a deletion request United States Standard Contractual Clauses (+ Transfer Impact Assessment) DeepSeek(opt-in) DeepSeek (China) DeepSeek visibility scans China No transfer mechanism published by the vendor — do not send personal data Meta AI (Muse Spark)(opt-in) Meta Platforms Ireland Limited (Ireland); processed by Meta Platforms, Inc. (USA) Meta AI visibility scans United States EU–US Data Privacy Framework (EU contracting entity; certified US processing entity) DataForSEO(opt-in) DataForSEO OÜ (Estonia) [DPA →](https://dataforseo.com/privacy-policy) Google and Bing search results for the Rank Tracker, for workspaces that use a Rank Tracker budget instead of their own DataForSEO account · Retention: Task data (including keywords) kept 365 days, then deleted EU (Estonia; data centre in Germany) and USA (cloud infrastructure); operations also in Ukraine Standard Contractual Clauses (+ Transfer Impact Assessment) ## Technical & organisational measures (Art. 32) - Encryption at rest — AI keys & OAuth tokens with AES-256-GCM at the application layer, over provider disk encryption - Encryption in transit — TLS 1.2+ with HSTS enforced - Tenant isolation — every query scoped to the authenticated team; cross-tenant access architecturally prevented - Access control — MFA required for production access; least-privilege; access logged and reviewed - Passwords — bcrypt (cost factor 12), never stored in plain text - Rate limiting — auth and critical API routes throttled per IP - Incident response — documented process; breach notification within 72 hours (Art. 33 GDPR) The full TOM annex is part of our Data Processing Agreement. ### Certifications We build to the controls behind ISO 27001 (encryption, access control, logging, incident response, resilience). Formal ISO 27001 certification is on our roadmap; in the meantime we support your vendor-security review with a signed DPA, this sub-processor list, our TOMs, and a completed security questionnaire on request. ### International transfers Where data reaches a third-country sub-processor (primarily the US), we rely on the EU–US Data Privacy Framework where the provider is certified, backed by EU Standard Contractual Clauses and a Transfer Impact Assessment. We keep SCCs in place even for DPF-certified providers, so transfers stay lawful if the framework changes. ## Documents for your review Everything your compliance team needs. Need a signed DPA (AVV) or our security questionnaire? Email [hello@crunchjunkie.io](mailto:hello@crunchjunkie.io). [Data Processing Agreement](https://crunchjunkie.io/legal/dpa) [Privacy Policy](https://crunchjunkie.io/legal/privacy)[Security](https://crunchjunkie.io/legal/security) Signed-in customers can export a live data-location report under Settings → Data & residency.