Where Forkin runs.
Every provider and data centre in the core stack is mapped. We picked EU/EEA infrastructure for jurisdiction, renewable contracts or low-carbon grids, and a smaller transfer footprint; limited US-linked processors are disclosed separately with safeguards.
Core app data runs in the EU/EEA
Forkin's database, object storage, core APIs, product AI analysis, embeddings, transcription, and CDN pull zone are hosted in the EU/EEA. We still use a small number of US-linked processors where the platform requires it or the service is ancillary - Apple/Google app distribution and push, RevenueCat subscriptions, Termly policy hosting, Expo push relay, Sentry corporate support, and Stripe group transfers. Those are listed in the sub-processor table with EU-US DPF and/or SCC safeguards. We do not use data brokers or advertising networks.
Who hosts what
Hetzner
Germany 🇩🇪Application servers, PostgreSQL database, Qdrant vector search, ETL pipeline.
European cloud, renewable-energy-powered data centres in Nuremberg and Falkenstein, ISO 27001-certified. EU-headquartered, not a US cloud provider.
Bunny.net
Slovenia 🇸🇮Edge CDN for static assets and image delivery (EU-only routing).
EU-headquartered, EU-only edge routing for our pull zone, no US points-of-presence for our traffic.
Hyperstack
Iceland 🇮🇸 (EEA)Always-on AI GPU — image and text embeddings (DINO, BGE-M3), speech-to-text (Whisper), meal scan depth pipeline, and text-to-speech.
GPU cloud in Reykjavik on near-zero-carbon geothermal and hydro (~28 gCO2e/kWh). EEA jurisdiction and GDPR apply; processing is limited to the inference task.
Scaleway
France 🇫🇷Generative AI (VLM/LLM) for label extraction and content moderation.
European OpenAI-compatible inference in their Paris data centre, on France's low-carbon grid (nuclear + renewables); Scaleway publishes its environmental footprint. This AI path stays in the EU.
Brevo
France 🇫🇷Transactional and marketing email.
EU-headquartered ESP. All mail relayed from French infrastructure under EU jurisdiction.
Sentry (EU region)
Germany 🇩🇪Error monitoring.
Their EU-region ingest stores all events inside the EU. Personal identifiers are scrubbed before send.
Stripe
Ireland 🇮🇪 (EU)Merchant of record for web payments.
Stripe Payments Europe, Ltd. (Ireland) processes web payments under EU law and handles VAT and chargebacks. We never store card details.
What stays in the EU/EEA
- Your scan history and pantry.
- Your diet preferences, allergens, and health-related signals.
- Your body measurements and progress photos.
- Your recipes, meal plans, and shopping lists.
- Your authentication credentials and account email.
The unavoidable exceptions
- iOS push notifications via Apple's APNs (US-routed, opaque device token only — no message content sent in clear).
- Android push notifications via Google's FCM (same as above, opaque token only).
- App Store and Google Play purchase receipts (validated via their APIs).