GDPR and EU hosting
What a CTO or data protection officer needs to know before sending documents with personal data through pagenull. Short, and every point links to the evidence.
Documents are never stored
The HTML, URLs and template data you send, and the PDFs and images you get back, are processed in memory and returned in the same response. They are never written to disk, to the database or to logs. There is no option to store them: if you want the file somewhere else, deliverTo uploads it to a presigned URL in your own storage. Saved templates are the one thing we keep on request; they are encrypted at rest and you can delete them at any time.
A test in our code fails if any code path writes request content or output to disk, or logs outside the metadata-only logger. Details: privacy & security.
A signed receipt per render
Every response carries a pagenull-receipt header: an Ed25519 signature over the SHA-256 of the exact bytes you got back, the time, the region, the renderer image and stored: false. Keep it next to the file. Anyone can check it against our published key, at /verify or offline. It proves what we produced and when; it can’t prove deletion, which rests on the points above and on the DPA.
Where it runs
One server at Hetzner Online GmbH (Germany) in Helsinki, Finland runs the website, the API, the renderer and the database. Backups are encrypted and kept on a Hetzner Storage Box in the same location. These are all the companies that process data for us:
| Company | What for | Location |
|---|---|---|
| Hetzner Online GmbH (Germany) | Hosting and backups | Helsinki, Finland (EU) |
| Creem (Armitage Labs OÜ, Estonia) | Payments (merchant of record) | Estonia (EU). Creem's privacy policy: providers outside the EU/EEA are covered by the EU standard contractual clauses. |
| Scaleway SAS (France) | Transactional email | Paris, France (EU) |
Only Hetzner ever handles document content, and only in server memory. Creem (payments) and Scaleway (password-reset emails) receive account data, never documents. The full list, with what each receives, is on /trust. We give 30 days’ notice before adding or changing one.
Website visits are counted with Umami, which we run ourselves on the same server: no cookies, no IP addresses stored, records deleted after 12 months. It never sees the dashboard or the API. See the privacy policy.
The data processing agreement
The DPA is on the site and applies automatically when you use the API: Article 28 terms, the technical measures, the sub-processors, breach notice within 48 hours, and audit rights. A countersigned copy is available on request from support@pagenull.dev.
What is logged
| Logged | Not logged |
|---|---|
| Per request: API key id, time, endpoint, status, size, duration. Kept 30 days. | Request bodies, HTML, URLs, template data |
The render id, which you get in pagenull-render-id | The output files |
| Your account: email, password hash, plan | IP addresses (rate limits use a short-lived hash in memory) |
The logger accepts a fixed list of metadata fields and drops anything else. The full list of what we store is in the privacy policy.
How to check this yourself
- Send a test render (free) and read the response headers:
pagenull-retention,pagenull-regionandpagenull-receipt. - Paste the receipt into /verify, or check it offline with the public key from
/.well-known/pagenull-keys.json. - Read the DPA and the sub-processors.
curl -s -D - -o test.pdf https://api.pagenull.dev/v1/pdf \
-H "Authorization: Bearer $PAGENULL_API_KEY" \
-H "Content-Type: application/json" \
-d '{"html":"<h1>Hello</h1>","test":true}' | grep -i '^pagenull-'The guide GDPR-compliant PDF generation lists the questions to ask any PDF vendor, including us.