Security and data protection
The providers, processing activities and safeguards applicable to this site.
Last updated: 12 September 2026
This page describes the technical supply chain of the Saviano website and each provider’s role.
It distinguishes public website data from information that future business software may process.
Four providers, and what each one sees.
The column that matters is not the provider's name, it is what the provider sees. A service that delivers a message reads its contents, and a content network that terminates encryption sees every request. Both are here.
| Provider | Role | Country | What it sees |
|---|---|---|---|
| Cloudflare, Inc. | Domain name zone, content delivery network and application firewall | United States | Every request made to the site. Encryption terminates on their network, so IP address, requested page, browser headers and, on a form submission, the content sent. |
| Hetzner Online GmbH | Server that runs the site | Germany, Nuremberg data centre | Server logs, and the form content while the request is being handled. Nothing is written to a database: this site does not have one. |
| Resend | Delivery of the contact form message | Ireland, eu-west-1 region | The content of the message, its sender and its recipients, for as long as delivery takes. |
| Hostpoint AG | Business mailboxes | Switzerland | Messages once received, as any mail host does. |
The public website and software programme
The site is hosted in Germany and uses Cloudflare. It processes contact enquiries and technical logs, although it has no customer accounts or document workspace.
The sovereign programme targets Swiss hosting. Architecture, providers and safeguards will be documented for each service before it becomes available.
What this site does not do
This site uses no audience measurement tools or advertising trackers. Fonts are served from our own server.
What we keep, and for how long
Server logs hold the IP address, the date, the resource requested and the response code. They serve diagnostics and security, and are deleted after thirty days.
The protection against repeated form submissions keeps a fingerprint of the requester's address in memory for ten minutes. It is never written to disk and disappears when the process restarts.
Enquiries that do not lead to a business relationship are retained for a maximum of 12 months after receipt. A contract or legal obligation may justify retaining the necessary records separately.
Managing data breaches
The person responsible for content is told immediately, and leads the risk assessment.
For a breach likely to create a high risk, the Swiss FADP requires notification to the FDPIC as soon as possible. Where the GDPR applies, its notification deadline must also be considered. The 72-hour period does not permit delaying a notification required under Swiss law.
The people concerned are informed where protection requires it or the Commissioner asks for it. The sequence of events is recorded as it happens rather than reconstructed afterwards.
Your rights, and how to exercise them
You have rights of access, rectification, erasure and objection under the Swiss Federal Act on Data Protection, and under the European General Data Protection Regulation where you live in the Union.
Write to [email protected], or use the contact form. We answer within thirty days, and we say no where we cannot grant a request rather than let the clock run out.
Security and compliance
Why list the providers?
To help visitors and organisations understand who processes data and in which countries.
Does Cloudflare really see the content of my message?
Yes. Encryption terminates on their network before reaching our server, which is how a content delivery network works. Saying so is the only honest way to present the chain, and it is also why the products that will handle sensitive documents will not be built this way.
Will you sign a data processing agreement?
Yes, for any relationship in which we process data on your behalf. The agreement names the processors, the places of processing and the retention periods, and it restates the list above rather than pointing at a page that can change.