GDPR Compliance
Share passwords, credentials, and sensitive data with full EU data residency. Your data stays in the region you choose β guaranteed.
Automatic expiration, end-to-end audit logging, and open source security architecture β built for GDPR compliance from the ground up.
On this page
GDPR Compliance Overview
Password Pusher is built for GDPR compliance from the ground up. With 15+ years in production and 100+ million secrets shared, we provide EU data residency, automatic data expiration, and full audit logging for organizations that need to meet GDPR requirements.
We operate two fully independent instances. Payload data is processed solely within your chosen region and never transferred outside it. A Data Processing Agreement (DPA) is automatically in effect for all EU hosted service users and publicly available at eu.pwpush.com/dpa.
Data Regions
Password Pusher operates two distinct data regions. Sensitive data provided in pushes and requests is processed solely within the chosen data region and is never transferred outside of that region.
EU Region (eu.pwpush.com)
Recommended for EU OrganizationsHosted on DigitalOcean in the Netherlands (EEA). Push payload data is processed and stored entirely within the European Economic Area.
US Region (us.pwpush.com)
Americas & Rest of WorldHosted on DigitalOcean in the United States. Ideal for North American organizations or teams without EU data residency requirements. EU Standard Contractual Clauses are in place for any cross-border data flows. Organizations requiring EU data residency should use eu.pwpush.com.
Data Protection by Design
Every feature in Password Pusher is designed with data minimization, purpose limitation, and storage limitation at its core.
Automatic Data Expiration
Every push automatically expires after a configurable number of views or time period. Data is permanently deleted β not archived, not soft-deleted. Gone.
Data Minimization
We collect only what is necessary to deliver the service. No tracking cookies, no behavioral analytics, no third-party ad networks. Plausible Analytics is anonymous and EU-based.
AES-256-GCM Encryption
All sensitive data is encrypted at rest using AES-256-GCM with per-field derived keys. The encryption layer is fully open source and auditable on GitHub.
Full Audit Logging
Complete lifecycle audit trail for every push: creation, views, expiration. Know exactly who accessed what and when β essential for GDPR accountability requirements.
Open Source Security Core
All security-critical code β encryption, data handling, expiry logic, audit logging β is fully open source and auditable on GitHub. Closed-source code covers only product features, never security.
Data Processing Agreement
A Data Processing Agreement (DPA) is automatically in effect for all organizations using the EU hosted service at eu.pwpush.com. View the full DPA at eu.pwpush.com/dpa β no separate signed document is required.
Subprocessors
We use only 5 subprocessors β and only one (DigitalOcean) ever handles your push payload data.
| Subprocessor | Purpose | Location | Handles Payload Data? | Safeguards |
|---|---|---|---|---|
| DigitalOcean | Hosting, database, backups | Netherlands (EU) or US | Yes | EU SCCs, SOC 2 |
| Stripe | Payment processing | United States | No | EU SCCs, PCI DSS |
| Brevo | Transactional email | France (EU) | No | EEA adequacy |
| Buttondown | Email newsletter | United States | No | EU SCCs |
| Plausible Analytics | Web analytics | European Union | No | EEA adequacy, no cookies |
Key point for EU customers: For the EU region, push payload data is handled exclusively by DigitalOcean in the Netherlands. No payload data is processed by any US-based subprocessor.
GDPR Article Alignment
Password Pusher's architecture maps directly to core GDPR principles. Here's how each principle is addressed:
Only the secret and minimal metadata are stored. No behavioral tracking, no unnecessary data collection.
Automatic expiration ensures data is not retained longer than necessary. Configurable by view count or time period.
AES-256-GCM encryption at rest, TLS in transit, per-field derived keys, and audit logging for every access event.
Ephemeral sharing is the core product β data destruction is a feature, not an afterthought.
Data Processing Agreement available on request. Only 5 subprocessors, fully documented. EU SCCs in place for non-EEA transfers.
EU region payload data stays in the EEA (Netherlands). For the US region, EU Standard Contractual Clauses govern any cross-border data flows.
Self-Hosting for Full Control
Maximum data sovereignty
Self-host Password Pusher in your own infrastructure. Your servers, your encryption keys, your rules. Apnotic never sees your data.
When you self-host Password Pusher, Apnotic is a software vendor β not a data processor. Your data never touches our infrastructure. You control encryption, access, retention, and compliance certification entirely within your own environment.
Your Infrastructure
Deploy via Docker, Kubernetes (official Helm charts), or bare metal. Run it on AWS, Azure, GCP, on-premises β anywhere you choose.
Your Encryption Keys
You control the master encryption key. Apnotic has no access to your data β we are a software vendor, not a data processor.
Enterprise SSO
Self-Hosted Pro Advanced and Enterprise include real enterprise SSO β configure your own Entra, Okta, Auth0, or custom OAuth2/OIDC provider.
Data Processing Agreement
A Data Processing Agreement (DPA) is automatically in effect for all organizations using the EU hosted service at eu.pwpush.com. Our standard DPA is publicly available at eu.pwpush.com/dpa and applies through acceptance of our Terms of Service β no separate signed document is required. It covers:
- GDPR Article 28 aligned processing terms
- Explicit data scope β Account Data (name, email, company) and Application Data (push/request payloads), with retention terms
- 72-hour breach notification, annual audit rights, and capped liability
Have GDPR or compliance questions?
Contact support@pwpush.com β we respond to compliance inquiries within 2 business days.
Last updated: May 2026 Β· Apnotic, LLC