Trust
Plain answers about where your data lives, who handles it, and what we do and do not claim. The full detail is in the privacy policy.
Last updated 29 October 2026
YesIn the EU. Account data, workflows and run history are stored in the EU. Connection credentials are held on a server in Nuremberg, Germany.
YesHetzner. Its data centres are certified to ISO/IEC 27001. The certificate belongs to Hetzner and not to us. See where your credentials are stored, below.
YesIn transit and at rest. Stored credentials are encrypted with a separate key and are never shown back to you in full. On top of that: each run is kept apart from other customers' runs, an AI assistant can only reach the toolbox you connect it to, and sessions end on their own.
YesCloudflare, Vercel, Hetzner, Upstash, our database host, Stripe and our mail service. Each is listed below with its certifications and a link to its own trust page.
NoNo to both. Workflow data is held only to run the workflow.
YesEach run executes in isolation from other customers' runs, and its sandbox is destroyed afterwards.
YesBy default a session ends after 12 hours of not being used, or after 7 days whatever you are doing. Then you sign in again.
YesWhat steps received and returned, their logs and the requests webhooks delivered: 90 days. Billing records are kept as long as tax law requires.
YesOnly the toolbox you connect it to. Never the values typed into a step, and never a token. Disconnect it and it stops at the next call.
NoNo. We do not hold a third-party certification and do not claim one. Our suppliers hold the certifications listed below.
YesWithin 72 hours of becoming aware of it. We tell the supervisory authority within the time the law allows.
YesYes, on request.
The authorisations your steps sign in with are held by Nango, software we run ourselves on a server at Hetzner in Nuremberg, Germany. We do not use Nango’s hosted service, so Nango the company receives nothing: not your tokens, not your account data, not the traffic your workflows generate.
Hetzner’s data centres are certified to ISO/IEC 27001, which covers the infrastructure, operation and customer support of its data centre parks in Nuremberg, Falkenstein and Helsinki.
This certificate belongs to Hetzner, not to VisualAutomate. The current one is on Hetzner's certification page.
Every supplier that handles any part of your data, what it does, and what it is certified for. The certifications are the supplier’s own. We list them as the supplier states them and link to its trust page, so you can check the current reports yourself.
| Who | What for | Where | Certifications | Trust page |
|---|---|---|---|---|
| Cloudflare | Runs your workflows | Global edge network | ISO 27001:2022ISO 27018ISO 27701SOC 2 Type IIPCI DSS Level 1 | cloudflare.com/trust-hub |
| Vercel | Hosts the application | EU and US regions | SOC 2 Type 2ISO 27001:2022PCI DSS v4.0TISAX AL2EU-US Data Privacy Framework | security.vercel.com |
| Hetzner | Holds connection credentials | Nuremberg, Germany | ISO/IEC 27001 (data centres) | hetzner.com/unternehmen/zertifizierung |
| Upstash | Live run state and caching | EU region | SOC 2 Type II (Pro and Enterprise plans) | trust.upstash.com |
| Stripe | Payments | EU and US | PCI DSS Level 1SOC 1 Type IISOC 2 Type IISOC 3 | stripe.com/legal/privacy-center |
| Our database host | Accounts, workflows, files | EU | Details on request | On request |
| Our own mail service | Account email | EU | Covered by the privacy policy | Not applicable |
None of them may use your data for their own purposes. We give at least 30 days’ notice before a new supplier starts handling your data, and you may object on reasonable data protection grounds.
The privacy policy carries the supplier list, the security measures and the transfer mechanism. We answer a reasonable security questionnaire once a year and share the documentation we hold.
Ask for the documents