Licensed to be used in conjunction with basebox, only.
// security
basebox Cloud (transition phase until November 2026)
Applies to
Product: Cloud (transition phase) · Audience: Data protection officers · Security / Compliance reviewer
basebox Cloud accounts created before the Cloud launch in November 2026 – including via Start for free – run in a shared environment until the move. This page describes what applies to data protection and security in this phase. For the Cloud after the move, see Cloud.
At a glance
| Aspect | Transition phase |
|---|---|
| Processing location, platform | Hetzner, Nuremberg |
| Processing location, AI models | Google Vertex AI, Frankfurt – model requests go to Google Vertex AI |
| Environment | Shared environment for all accounts of this phase, logically separated from one another, with shared user management |
| Role of basebox | Processor (DPA) |
| Sub-processors | Hetzner (platform), Google (AI models) |
| Backup | Daily, retained for up to 7 days |
| Special categories (Art. 9 GDPR) | Best processed only after the move |
| End | Move to the Cloud by basebox; no new registration |
Processing location
The basebox platform runs at Hetzner in Nuremberg. The AI models are provided by Google Vertex AI in Frankfurt: every model request – prompt, history, retrieved context and document contents, insofar as they are part of the request – goes to Google Vertex AI. Unlike in the Cloud after the move, every model request therefore leaves the platform environment. Google does not use the inputs for training and logs them for abuse detection for no longer than 30 days (Data flows, Model providers).
Shared environment
All accounts of the transition phase share one environment. The organizations are logically separated from one another; user management is shared. A dedicated environment per organization, as described under Isolation, exists only after the move.
Role of basebox and DPA
You are the controller within the meaning of the GDPR. basebox acts as a processor in the transition phase as well; the DPA applies: basebox.ai/en/dpa. Application administration and data sit with you as in every model (Shared responsibility).
Sub-processors in this phase
| Party | Role | What |
|---|---|---|
| basebox GmbH | Processor | Operation of the environment |
| Hetzner, Nuremberg | Sub-processor | Shared environment: logically separated, shared user management |
| Google Vertex AI, Frankfurt | Sub-processor | AI models: model requests go to Google Vertex AI |
The DPA and the list of sub-processors are authoritative (Data processing & sub-processors).
The move
basebox moves the accounts of the transition phase to the Cloud: a dedicated environment per organization in the data center of noris network AG in Munich-East (Cloud). No new registration is needed. After the move, the Cloud's sub-processors apply, and basebox deletes your data in the transition-phase environment.
Backup
basebox backs up the environment daily and retains the backups for up to 7 days.
Special categories of personal data
Health data and other special categories of personal data under Art. 9 GDPR are best processed only after the move.
For the review
- Include Hetzner and Google in your record of processing activities for the duration of the transition phase.
- Specify that Art. 9 data is processed only after the move.
- After the move, align the assessment with the Cloud.
How users get into the transition phase and what applies there: Start for free · Transition phase.
Questions on the DPA and sub-processors: datenschutz@basebox.ai.
Next step: Cloud