Trust · itbudgit

The short version

Application	Hetzner, Falkenstein, Germany
Database	Neon Postgres, Frankfurt (`eu-central-1`)
In front	Cloudflare. DNS, WAF and proxy only, not a host
Ownership	EU-owned infrastructure throughout
Isolation	Row-level security on every tenant table, audited against the live database on each deploy
Backups	Nightly logical export, 03:15 UTC. The restore path is rehearsed, not assumed
Point-in-time recovery	Six hours. See the limit stated in full on Security

What we do not claim

This section exists because its absence is where vendors quietly overstate. None of the following is true of itbudgit today, and none of it appears anywhere else on this site:

No SOC 2 and no ISO 27001. Neither is held, and neither is in progress. ISO 27001 has been assessed and ruled out as a single-person initiative
No penetration test has been performed.
No uptime SLA is offered. One will not appear until it can be measured and honoured
No free trial. Plans are annual, and what you see on the pricing page is what is sold

itbudgit is run by one person. That is a real constraint and it is better stated than discovered.

The rest

Security. Architecture, isolation, backups, and the recovery limit in full
GDPR. Roles, lawful basis, your rights, and how erasure actually runs
Sub-processors. Every third party that touches the service
DPA. The data processing agreement
Privacy · Terms · Cookies