This page explains where the data of Cloud Studio IoT platform customers is stored, which external services the platform can use, how access is secured and how data protection obligations are handled. It is written for buyers, integrators and legal teams evaluating the platform. For the data collected through this website, see the privacy policy.

Where data is stored

Customer data is stored in the infrastructure of the deployment option chosen:

Shared platform (gear.cloud.studio) and dedicated instances in the United States: Amazon Web Services, us-east-1 region (Northern Virginia, USA).
Dedicated instances in the European Union: Amazon Web Services, eu-central-1 region (Frankfurt, Germany).
On-premise instances, installed in the customer's own infrastructure: the data does not leave it.

The customer chooses the region or the deployment option when signing the contract.

Subprocessors and external services

The platform integrates the following external services. Each instance only uses the ones configured for it, so a given instance may use fewer than those listed.

Amazon Web Services: hosting, database and file storage (Amazon S3).
Auth0: user authentication.
Google: Firebase Cloud Messaging for push notifications, and Google Maps for maps and geocoding.
Anthropic: only if the customer turns on the AI Copilot, which is off by default.
ClickSend and Plivo: SMS, voice calls and WhatsApp messages.
Waapi and Meta (WhatsApp): WhatsApp messages.
Microsoft Azure: text to speech.
OpenWeatherMap: weather data.
Numverify: phone number validation.
Restpack and ScreenshotAPI: PDF generation for reports.
The LoRaWAN networks the customer chooses, such as The Things Stack, ChirpStack, Loriot or Helium.

Security

Traffic with the platform and the API is encrypted over HTTPS; HTTP requests are redirected to HTTPS.
API access uses access tokens. A token inherits the permissions of the user who creates it and can be revoked at any time.
The platform keeps a log of user activity. Entries are kept for 365 days by default; each customer can set a different period, with a minimum of 90 days.
Backups are made weekly.
Security issues can be reported following the responsible disclosure contact in /.well-known/security.txt

GDPR

For the data customers store in the platform, Cloud Studio IoT acts as data processor and the customer as data controller.
A data processing agreement (DPA) is available on request.
When the contract ends, the customer can export its data. The data is then deleted from the platform within 30 days.
Data subjects can exercise their rights through the channel described in the privacy policy

Contact

For security or data protection questions, write to info@cloud.studio