Why the storage location matters
Where your files are stored helps decide which law applies to them and who may access them in an emergency. If the data sits in a data centre in Germany, German and European data protection law apply – above all the General Data Protection Regulation (GDPR).
For individuals this is mostly peace of mind: photos, tenancy agreements, certificates and tax documents are not stored somewhere around the world, but in a place whose rules you know. For businesses it is often a hard requirement. They remain responsible for the personal data of their customers and staff – even when a service provider stores it.
There is also a very practical side: a data centre close to you means short network paths. You notice it when uploading large files and opening folders with many items.
What exactly is in Germany – and what is not
"Data in Germany" sounds clear, but rarely is. A cloud service consists of several parts, and they are not necessarily all in the same place. At SafeDoc it looks like this:
| Component | At SafeDoc | What to check with others |
|---|---|---|
| Your files | Data centre in Germany | Does this also apply to older versions and the trash? |
| Database (folders, shares, account) | Data centre in Germany | The database reveals file names and who shares with whom. |
| Backups | Planned: Germany, separate from live operations (being set up) | Are copies kept in another country? |
| Payment processing | External payment providers | Card payments almost never stay within one country. |
| Email delivery | External delivery service | What content is in the emails? |
Honest providers tell you this openly. The service providers we use and where they operate are listed in our privacy policy. Be careful if a provider claims that absolutely everything stays in the country – by the time you pay by credit card at the latest, that is almost never true.
The legal framework in brief
Three terms come up again and again when choosing. Briefly explained – as guidance, not legal advice:
- GDPR: the European General Data Protection Regulation governs how personal data may be processed. It applies to providers offering their services in the EU – regardless of where their servers are.
- Data processing (Art. 28 GDPR): if a company stores personal data with a cloud provider, the provider processes it on the company's behalf. This requires a data processing agreement (DPA) that sets out what the provider may do with the data.
- Transfers to third countries (Art. 44 et seq. GDPR): if data goes to a country outside the EU, additional requirements apply. If all parts of a service are in Germany, this point does not arise for the core of the service.
Keep in mind: where a provider has its registered office can also matter – for example if foreign law can oblige it to hand over data. The server location alone does not answer that question.
Location is not the same as security
A German data centre does not automatically protect against mistakes, attacks or data loss. What the provider does matters just as much. Look out for these points:
- Encrypted transfer on every access (HTTPS).
- Passwords only as hashes – never stored in plain text.
- Protection against guessing passwords at sign-in and on protected links.
- Separated accounts: permissions are checked on the server for every access.
- Versions and trash, so that a mistake – or ransomware on your computer – does not destroy everything.
- Backups, kept separate from live operations.
How we do this at SafeDoc, and what of it is already in the product today, is on our security page. It also describes the private vault for especially sensitive files, whose content only you can decrypt Beta.
Personal or business: different requirements
Depending on what you use cloud storage for, different points matter:
| Topic | Personal | Business |
|---|---|---|
| Location | Peace of mind, short paths | Often required by data protection or contracts |
| Contract | Terms of use | Plus a data processing agreement |
| Access | Family via link | Roles: who reads, who edits, who manages |
| Billing | Price incl. VAT | Net price, VAT on the invoice |
| Recovery | Bring back photos deleted by mistake | Trace who changed what |
Eight questions for any provider
These questions separate marketing promises from solid statements. A good provider answers them in writing:
- Which data is stored in Germany – only the files, or the database and backups too?
- Which external service providers are involved, and where are they based?
- Is there a data processing agreement for businesses?
- How are passwords and share links stored?
- How long can deleted files and older versions be restored?
- Do versions and the trash count towards storage – and what happens when it is full?
- How are links protected: password, expiry date, download limit?
- Can I cancel at any time and still download my files afterwards?
How SafeDoc answers the eight questions
| Question | Answer |
|---|---|
| 1. Location | Files and database are stored in data centres in Germany. Backups are also planned for Germany; they are being set up right now. |
| 2. Service providers | Hosting, payments, email – listed in the privacy policy. |
| 3. DPA | Yes, for businesses under Art. 28 GDPR. Signing in the account is coming. |
| 4. Passwords and links | Stored only as hashes; limits against guessing. |
| 5. Recovery | 30-day trash on every plan, versions 30 days on Plus, 90 days on Pro, Familie, Business and Business Pro. |
| 6. Storage full | Versions and trash count; a full storage only pauses new uploads. |
| 7. Links | Password, expiry and download limit from Plus; "view only" on every plan. |
| 8. Cancellation | By button in the account; files can still be downloaded afterwards (period per terms). |
Conclusion
"Cloud storage in Germany" is a good start, but not a complete answer. Ask exactly which parts of a service run where, how it protects accounts and links, and how you get your data when you leave.
For businesses, roles and the data processing agreement come on top – find out more under SafeDoc for business. If you are planning a switch, our moving guide helps. This text is general guidance and not legal advice.