EU-only, by construction. Evidence produced by the platform, not assembled by your team.
Everything below applies to every package. Where an auditor needs a document, the platform already keeps it.
Location and residency
- Servers in Falkenstein and Nuremberg, Germany, and Helsinki, Finland
- Backups replicated to a second EU site, never outside the EU
- Metrics and logs stored and retained in the EU
- Engineers and Exa operate from the EU; no follow-the-sun access from other jurisdictions
Access
- SSH keys only, root login disabled, WireGuard for administrative access
- Named accounts for every Infraexa engineer, every session logged
- Out-of-band management on Enterprise packages, reachable only from the Infraexa network
- Customer roles for dashboard and Exa access
Hardening and patching
- Documented baseline applied at delivery and checked weekly for drift
- Automatic security updates; critical CVEs patched within 72 hours
- Kernel and firmware updates in agreed windows with tested rollback
- Unused services disabled, deny-by-default firewall
Network
- Always-on volumetric DDoS mitigation at the edge
- Managed host firewall with intrusion detection
- Private VLAN between your servers, isolated from other customers
- IPv6 by default, reverse DNS under your control
Backups and recovery
- Nightly encrypted snapshots to a second EU site
- Keys you can hold; append-only storage so production credentials cannot delete history
- 30-day retention, 90 days as an add-on
- Quarterly restore test with a written report; hardware replacement within four hours
Monitoring and evidence
- Weekly vulnerability scans prioritised against installed packages
- Immutable change log of every action by us, by Exa or by you, with approver
- Exportable audit evidence: access log, change log, scan summaries, restore reports
- Incident write-up for every disruption, published to your account
Documents ready to sign or send.
Available before you order, not after.
- Data processing agreement
- Read the DPA
- Sub-processors
- Current list with locations
- Service level agreement
- Availability, response times, credits
- Security questionnaire
- Ask for a completed standard questionnaire
- Data centre certifications
- ISO 27001 certified facilities; certificates on request
Have a security questionnaire? Send it.
An engineer answers it, not a sales team, usually within three business days.