Honest about what we hold — and what we do not.

Our role: Controller for site visitors; Processor for customer message data

Our Data Protection Officer is reachable at [email protected]. Article 28 DPA published at /dpa. Sub-processor list public at /dpa#sub-processors with 30-day change notice. Breach notification commitment: 48 hours (stricter than the 72-hour regulatory floor). Records of Processing Activities (Article 30) maintained. Multiple DPIA exercises completed with regulated-industry customers.

Our role: Important entity in the digital infrastructure sector

NIS2 entered force across EU Member States in October 2024 and is fully in effect throughout 2025-2026. Our security risk management (Article 21) follows the ten technical and organizational measures explicitly: policies on risk analysis, incident handling, business continuity, supply chain security, network security, access control, multi-factor authentication, cryptography, asset management, and human resources security. Incident notification readiness is 24 hours / 72 hours / 1 month as required by Article 23.

Our role: ICT third-party service provider to financial entities

DORA applies to financial entities and their critical ICT third-party providers. We are not a Critical ICT Third-Party Provider (CTPP) ourselves at our current scale, but we have several customers in EU banking, insurance, and fintech who require DORA-compatible contract terms. Our standard Enterprise DPA addendum includes Article 30(2) contractual provisions, exit-and-portability rights, sub-contracting controls, and audit rights as required by DORA Article 30. We provide annual operational resilience attestations to financial-sector customers.

Our role: Data exporter to non-EEA sub-processors

For each cross-border data transfer (Cloudflare US entity, Stripe US parent, our own DFW and PTY PoPs), we maintain a current Transfer Impact Assessment evaluating destination-country laws (CLOUD Act, FISA Section 702, EO 12333 for the US; equivalent analyses for Panama). Supplementary measures documented: encryption in transit (TLS 1.3), encryption at rest (AES-256), pseudonymization where applicable, contractual NDA chains. Enterprise customers can prohibit any non-EEA processing.

Our role: Digital service provider to EU consumers and businesses

The EAA entered enforcement on 28 June 2025. Our public website conforms to WCAG 2.2 AA via EN 301 549 v3.2.1 with three documented minor exceptions (see /accessibility for the gap register). The customer portal is audited separately; conformance documentation available on request. We do not use accessibility overlay widgets — the European Disability Forum has stated overlays do not satisfy EAA requirements.

Our role: Provider of digital services without AI components

OS Domains does not deploy AI systems classified as high-risk under Annex III of the AI Act. We do not use AI for hiring decisions, customer scoring, or any other regulated use case. Some internal tooling uses machine-learning models for spam classification and anomaly detection in our own logs; these operate on aggregated, pseudonymized data and do not make decisions about identifiable natural persons. No conformity assessment under Article 43 is required for our current operations.

Our role: Not a payment processor

We do not process, store, or transmit payment card data. Customer subscription payments are processed by Stripe Payments Europe Ltd., which is PCI-DSS Level 1 certified. Card data never touches our infrastructure. For Enterprise customers in financial services who require contractual confirmation, we provide a signed letter of attestation that we are out of scope for PCI-DSS.

Our role: Not a US healthcare-sector vendor

We are not a HIPAA Business Associate and do not offer Business Associate Agreements. Our customer base is overwhelmingly EU-based and we do not optimize for the US healthcare market. Customers handling US Protected Health Information should use a HIPAA-compatible vendor. EU-based healthcare customers (covered under GDPR Article 9) are accommodated through standard DPA terms and custom Special Category Data addenda.