Where your data lives, and who sees it

“Secure” and “GDPR-compliant” sit on every hosting page. What matters is what stands behind them: which machine holds the data, who has the key, what happens when you leave. Here it is.

The servers are in the EU

Podless runs on machines in data centres in Germany and France. Bulk storage for photos, files and backups sits in Frankfurt. There is no path along which your content travels to a data centre outside the EU; who processes the data there on our behalf is listed in the privacy policy.

Every app gets its own environment

Your app is not a tenant inside one large shared installation. It runs in its own containers, with its own database and its own limits for CPU, memory and storage. Two things follow: no neighbour can take your compute, and a flaw in somebody else’s app cannot reach your data.

Encrypted where it counts

• In transit: every address — the one on podless.app and your own domain — carries a valid certificate. Unencrypted is not offered at all.
• At rest: configuration, database credentials and backup keys are stored with AES-256-GCM and decrypted only when your app starts.
• In backups: every backup is written encrypted, with a password only you hold. Without that password a backup is noise, to us as well.

Backups belong to you, not to us

The daily backup is written into your own S3 bucket. You provide the credentials, you pay for the storage, you can move it elsewhere at any time. You restore any state from the dashboard, and because the storage is yours, the backup is still with you if you are somewhere else tomorrow. That is deliberate: a backup that is only worth something at the provider is a lock-in clause, not a backup.

No tracking, one cookie

This site and the dashboard run no analytics scripts, no ad networks and no third-party cookies. A single cookie remembers your language. That is also why there is no consent banner here — there is nothing to consent to. What happens inside your app we do not see anyway: we know how much CPU it draws, not which photos are in it.

What you can lock down yourself

• Limit which IP addresses can reach an app at all.
• Two factors and passkeys for every account.
• Search engines are kept away from every app address.
• Deleting an app deletes its data — no waiting period, no form.

Leaving is easy, on purpose

Podless hosts open source. The same software keeps running on your own server if you want it to. You fetch your files over a time-limited SFTP access, you reach the database with credentials from the dashboard, and your backups sit in your own storage anyway. We do not build a door that only opens from the inside.

Found a hole?

Write to hi@podless.app. We read every report, answer quickly and tell you what we did with it. We will credit you by name if you want — and keep quiet about it if you do not.