Legal
Trust & Data Protection
Effective September 2, 2026
Where your data lives, who processes it, how long each kind is kept, and how you exercise your rights — stated precisely, because compliance is done once (LGPD + GDPR together) and then stays out of your way.
1. Where your data lives
The control plane (API, database, panel) and the authoritative nameservers run on Hetzner infrastructure in the European Union (Germany). Payments are processed by Stripe in the United States — card data never touches our servers. Transactional e-mail is sent through qsendyx, a Quathos service.
We state locations instead of promising “data residency”: if a contract requires a specific residency, that is a conversation, not a checkbox.
2. Subprocessors
Each subprocessor, what it does for us, and where it processes:
- Hetzner Online GmbH — servers and network for the control plane and nameservers — Germany (EU).
- Stripe, Inc. — payment processing and invoices — United States.
- qsendyx (Quathos LLC) — transactional e-mail delivery — European Union.
3. Retention, enforced automatically
Retention here is executed by a daily purge job, not just written down:
- Query analytics: per your plan (24 hours to 12 months).
- Audit log: per your plan; reading is cut to the plan window, purge uses the most generous plan so an upgrade restores history.
- Nameserver probe samples: 14 days (aggregates are kept).
- Resolved alerts: 90 days. Open alerts never expire — they are current problems.
- Used or expired e-mail tokens: 30 days.
- Invitations never accepted: 90 days — third-party e-mail addresses are the clearest thing to minimize.
- E-mail delivery records: 12 months.
4. Your rights, self-serve
Export everything (JSON, with each zone also as a BIND zonefile ready to import elsewhere) from Panel → Account → Export. Deletion is scheduled with a 7-day grace period, notified by e-mail with one-click cancel, and then completed — zones removed from our nameservers included. Neither requires a support ticket: an unlocked exit is part of the product.
5. Staff access, visible to you
Every action a Quathos Monitor platform operator takes on your organization is recorded and shown in your organization page. If we touched it, you can see it.
6. DPA and contact
A Data Processing Agreement (LGPD/GDPR addendum) is available on request at contact@quathos.com — electronic acceptance inside the panel is being built. The same address reaches our data protection officer for any privacy request.