International Access to Data

Voidhash s.r.o. · Version 1.0 · Effective from 14 October 2026

1. Purpose

1.1. This page provides the information required by Article 28 of Regulation (EU) 2023/2854 (the "Data Act"): the jurisdiction to which the infrastructure used to provide the Voidhash hosted cloud service (the "Service") is subject, and the technical, organisational and contractual measures we take to prevent international governmental access to, or transfer of, non-personal data held in the European Union where it would conflict with EU law or the law of a Member State (Article 32 of the Data Act).

1.2. It forms part of the Terms of Service. Personal data are additionally protected under the GDPR, as described in section 7.

2. Jurisdiction of our infrastructure

2.1. Voidhash s.r.o. is a company established in the Czech Republic and subject to EU and Czech law.

2.2. We provide the Service using the following infrastructure providers. All of them are companies incorporated in the United States and are therefore also subject to US law.

The current list of subprocessors and their locations is kept on the Subprocessors page. We do not use Customer Data, Customer Content or End User data to train AI or machine-learning models, and we do not permit our AI providers to do so.

2.3. In summary, Customer Data and Customer Content are stored and processed mainly in the eastern United States, and requests may be processed at Cloudflare edge locations worldwide.

3. What this means

3.1. Because our providers are US companies, US authorities may, under US law, require them to disclose data in their possession, custody or control, including data stored outside the United States. Relevant laws include in particular:

1. the CLOUD Act (18 U.S.C. § 2713), which allows US law-enforcement warrants and orders to reach data held by providers subject to US jurisdiction regardless of where the data are stored;
2. Section 702 of FISA (50 U.S.C. § 1881a), which allows targeted collection of foreign-intelligence information from electronic communication service providers; and
3. Executive Order 12333 on intelligence activities outside the United States.

3.2. For personal data transferred under the EU–US Data Privacy Framework, US intelligence access is subject to the limitations and redress mechanism of Executive Order 14086, including the Data Protection Review Court. These safeguards do not extend to non-personal data in the same way.

3.3. Such a request could be addressed directly to a provider without our involvement. Our ability to prevent or learn about it therefore depends partly on the provider's own policies.

4. Technical measures

1. Encryption in transit: data are encrypted in transit (TLS).
2. Encryption at rest: our hosting providers encrypt stored data. Credentials you give us for stores, payment and push providers are additionally encrypted at the application level with a key under our control.
3. Access control: access to production systems is restricted to authorised personnel; data are logically separated by organisation and project.
4. Minimisation: we collect only the data needed to provide the Service, do not read advertising identifiers, keep technical logs for 30 days, and provide erasure tools for End User data.

5. Policy on government requests

5.1. If Voidhash receives a request from a public authority of a country outside the EU to access or transfer Customer Data or Customer Content, we will:

1. require valid legal process — we do not provide access voluntarily or on informal requests, and we provide no "backdoor" or direct access to our systems;
2. assess legality — we will assess the request under EU and Czech law; we will disclose data on the basis of a decision of a third-country court or authority only where it is based on an international agreement in force (such as a mutual legal assistance treaty), or where the conditions of Article 32(3) of the Data Act are met; we may seek the opinion of the competent EU or national authority;
3. redirect the authority to request the data from the Customer directly, where possible;
4. challenge requests that are overbroad, unlawful under the applicable law, or conflict with EU or Member State law, using the available legal remedies;
5. disclose the minimum — if we are obliged to comply, we disclose only the minimum amount of data permissible based on a reasonable interpretation of the request;
6. notify the Customer before complying, unless we are legally prohibited from doing so (for example where notice would jeopardise a criminal investigation, and only for as long as necessary); and
7. document each request, our assessment and our response.

5.2. Requests from EU and Czech authorities are handled in accordance with the applicable EU and Czech procedural law.

6. Contractual measures

1. We conclude data processing agreements with our providers that bind them to process data only on our instructions and to protect it.
2. Our Terms of Service and Data Processing Addendum contain our commitments to Customers set out in section 5.

7. Personal data

Transfers of personal data to the United States are governed by Chapter V of the GDPR. Transfers rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses. Under Article 48 GDPR, a judgment or decision of a third-country authority requiring a transfer of personal data is recognised only if based on an international agreement. See the Privacy Policy, the Data Processing Addendum and the Subprocessors page.

8. Your options

1. Minimise — do not send data to the Service that it does not need (for example, avoid identifying End Users by email address).
2. Self-host — the open-source Community edition can run on infrastructure of your choice, including in the EU, so that no data are held by Voidhash.
3. Enterprise — Enterprise customers can discuss self-hosting or deployment in their own cloud account (bring your own cloud).

9. Contact and changes

Questions about this page: legal@voidhash.com. Authorities can contact us at the same address (in Czech or English). We will update this page when our providers, the locations of data or our measures change, and record the change in the version table above.