Infrastructure and providers

Understand Kilo’s hosting-provider responsibilities and request the supplier information needed for your deployment.

Kilo uses Hetzner for cloud infrastructure. Kilo remains responsible for its application, account access, configuration and recovery arrangements. Your organisation remains responsible for its devices, local networks, account membership and purposes of use.

A supplier assessment covers the supplier's stated services, locations and period. It is separate from Kilo's assessment status.

Contact info [at] kiloiot.de (replace [at] with @) if your assessment requires specific hosting, processing-location or assurance information. Explain the service and requirements you are assessing so the relevant scope and handling restrictions can be established.

The providers involved depend on the service and integrations used. Obtain the applicable processing agreement and provider information for your arrangement before introducing restricted data. This overview is not a complete list of subprocessors: the companies engaged to process personal data on another organisation's behalf.

Hosting locations and their limits

The September 2026 infrastructure checks identified Kilo cloud computing resources at Hetzner sites in Falkenstein and Nuremberg, Germany. This identifies the inspected computing locations. It does not establish the location of every database, backup, support record, assistant-provider copy or onward processor.

Before relying on a location restriction, obtain confirmation for the actual service, data categories and providers in your agreement. The hosting provider's location alone does not establish where all access or processing takes place.

Requests from public authorities

A request from a public authority needs an assessment of the authority, legal basis, requested information and applicable safeguards. Kilo's handling procedure requires that assessment before disclosure, a limited response where disclosure is lawful, and a record of the decision. It also addresses customer notification where required and permitted, and requests that conflict with applicable European law.

Personal information and non-personal customer information have different legal rules. For non-personal data held in the European Union, the EU Data Act addresses conflicting government access from other countries. A request alone does not establish a lawful basis to disclose the data. This procedure is not a promise that Kilo can prevent every lawful authority request or that every supplier's safeguards have been independently assessed.

Read Shared security responsibilities for the practical division of work.

Processing arrangements

Use Processing agreements to identify the actual providers, processing roles, authorisations and location requirements for your service. A supplier name or computing location alone does not establish the complete agreement.