Data Processing Addendum
When you store data inside a database hosted on DBHost, you are the data controller and DBHost is your data processor. This addendum forms part of your Terms of Service and describes how DBHost processes the personal data you upload on your behalf.
1. Scope
This DPA applies whenever DBHost processes personal data on a customer’s behalf — primarily the row-level contents of the customer’s PostgreSQL databases. The customer is the data controller; DBHost is the data processor.
2. Subject matter, duration, nature, purpose
Subject matter: provision of managed PostgreSQL hosting, including pooling, backups, dashboard, and API.
Duration: for the term of the customer’s subscription, plus the wind-down windows described in section 10 (Return + deletion).
Nature: storage, transmission, backup, and operational maintenance of customer-supplied database contents.
Purpose: to provide the service the customer has subscribed to.
3. Categories of data subjects and personal data
The categories of data subjects and personal data are defined by the customer through how they use their database. DBHost does not inspect or classify row-level contents as part of normal service operation and does not classify the data on the customer’s behalf.
4. Sub-processors
DBHost engages the following sub-processors. We give advance notice of material changes where practicable and provide a reasonable opportunity to object on substantiated data-protection grounds.
| Sub-processor | Role | Region | Transfer mechanism |
|---|---|---|---|
| Vercel | Hosting (control plane) | EU compute (Stockholm, arn1); global delivery network | EU SCCs where applicable |
| Hetzner | Control-plane and tenant database hosting | HEL1 (Helsinki, Finland) | EU |
| AWS S3 | Encrypted backups | eu-north-1 (Stockholm) | EU |
| Clerk | Authentication | US | EU SCCs |
| Stripe | Payment processing | US | EU SCCs |
| Resend | Contact and operational email delivery | US | EU SCCs / EU-US DPF |
| BetterStack | Status page + uptime monitoring | EU | EU |
5. Tenant isolation
Free, Pro and Business run on shared infrastructure: a single-region data-plane VPS hosting a multi-tenant PostgreSQL instance. Separate PostgreSQL roles and database grants restrict ordinary SQL access. Statement, lock, and idle-in-transaction timeouts are role defaults that a permitted SQL session can change; a PgBouncer server connection cap is shared by all roles in each database. That cap defaults to 3 and owners can adjust it from 2 to 8. CPU, memory, and disk remain shared; these controls do not provide dedicated physical resources for each tenant.
Customers who require dedicated infrastructure can request a manually quoted Dedicated service. It is not a fourth self-service app plan.
6. Security measures
The technical and organisational measures DBHost implements are described in our Security policy and form part of this DPA by reference.
7. Data subject requests
If DBHost receives a data subject request directly, we forward it to the customer without delay and do not respond on the customer’s behalf unless instructed.
For requests routed through the customer, DBHost assists with technical actions (read-only access, export, deletion) within a reasonable time, typically within 30 days.
8. Personal data breach notification
In the event of a personal data breach affecting customer data, DBHost notifies the affected customer without undue delay after becoming aware of it. The notification includes, as information becomes available, the nature of the breach, the affected data, likely consequences, and measures taken or proposed to address it.
9. Audits
The customer has the right to audit DBHost’s compliance with this DPA. Audits are conducted via written questions; DBHost responds in writing within 30 days. On-site audits are not practical for a one-person operation, but we are happy to schedule a video call for follow-up questions.
10. Return and deletion of customer data
- Following a verified request to terminate the service and delete the account data, DBHost completes the operator-run deletion process on the primary host within 30 days. Cancelling or downgrading a paid plan does not by itself delete databases.
- Backup objects under
prod/<dbname>/in the S3 backup bucket expire automatically through the bucket lifecycle rule, on a 30-day rolling window. A separate backup created by the managed deletion flow follows that database’s seven-day recovery window. Infrastructure VM backups and manually retained tenant-node snapshots can contain customer data after database deletion or a preview lease ends. They are not governed by the logical-backup lifecycle rule. DBHost retains the three newest available manual tenant-node snapshots and deletes older ones after a protected restart is committed and verified. This rolling count has no fixed maximum age. Deleting a database cannot remove its bytes from an already retained full-node image. - Account metadata and audit records follow the retention criteria in our Privacy policy and any applicable legal obligations.
- Customers can request earlier deletion at any time per the process in our Privacy policy.
11. Liability and governing law
Liability under this DPA is governed by the limitations in the Terms of Service. The DPA is governed by the laws of Norway.
Questions?
Need a counter-signed copy, or have questions about a specific sub-processor or transfer? Reach out and we’ll respond promptly.
Contact the team →