Regulation (EU) 2023/2854 (the “EU Data Act”) requires providers of data processing services to be transparent about where, and under which legal systems, their customers’ data is processed.
Article 28 requires providers to publish, and keep up to date, two pieces of information:
the jurisdiction of the ICT infrastructure used to deliver their services;
the measures adopted to prevent international governmental access to, or transfer of, non-personal data held in the European Union where such access or transfer would conflict with EU law or with the national law of the relevant Member State.
This page fulfils that obligation for the Servitly DPS. It describes the cloud providers and data center regions on which the DPS runs, the jurisdictions to which they are subject, and the technical, organisational and contractual safeguards Servitly applies to protect Customer Data against unlawful access requests from third-country authorities.
The information on this page applies primarily to non-personal data, such as telemetry and Metric Data generated by connected Products. The processing of personal data, including any transfer outside the European Economic Area, is governed by the GDPR and by the Data Processing Agreement (Servitly - DPA) entered into with the Customer.
Environment | Cloud Provider | Data center | Jurisdiction |
|---|---|---|---|
Production (EU) | Amazon Web Services Ireland | Ireland (eu-west-1) | EU – Ireland |
Production (APAC) | Amazon Web Services Hong Kong | Hong Kong (ap-east-1) | Hong Kong SAR |
Production (EU) | Microsoft Ireland Operations Ltd | Germany West Central | EU – Germany |
Develop / Staging | Microsoft Ireland Operations Ltd | Germany West Central | EU – Germany |
Customer data is hosted exclusively in the region agreed in the Commercial Offer.
The EU region is the default; the APAC region is used only for customers who explicitly request it.
Servitly S.r.l. is an Italian company subject to Italian and EU law.
The full list of sub-processors is available on the Sub-processors and Third-Party Services page.
The cloud providers’ parent companies are established in the United States and may be subject to third-country laws, such as the US CLOUD Act.
Measures against unlawful international governmental access:
Technical:
Encryption of data in transit (TLS) and at rest.
Data of EU-hosted customers stored only in EU regions, in at least two Availability Zones.
Database access allowed only through the authenticated API Gateway. No direct access to databases or support services.
Role-based access control, multi-factor authentication, and logging of all administrative access to servers, databases, and backups.
Organisational:
An internal procedure for government access requests:
legal review of every request;
verification of its compatibility with EU and Member State law;
rejection of requests lacking a valid legal basis;
disclosure limited to the minimum strictly required.
Access to production systems restricted to authorised Servitly personnel.
Contractual:
Servitly’s use of AWS and Microsoft Azure is governed by the providers’ standard terms. These include data processing addenda that apply automatically to all customers, without individual negotiation:
AWS: the AWS Data Processing Addendum and its Supplementary Addendum (announcement and summary).
Microsoft: the Microsoft Products and Services Data Protection Addendum, section “Defending your data”.
Obligations flowed down to all sub-processors.
Servitly will notify the Customer of any government request concerning Customer Data received directly by Servitly, unless prohibited by law.
Updates to this page
This page forms part of the Agreements referred to in the Terms and Conditions page, and it is updated whenever the infrastructure or the applicable safeguards change.
Each update to this page will be marked with its effective date, according to the Terms and Conditions.
In the event of any inconsistency, the provisions of the Agreement and of the Commercial Offer prevail.