Security

What happens to your data in GeoStars, where it is stored and who can see it. For IT, data protection and procurement on one page.

As of: 09.10.2026

At a glance

• Provider in Germany: GeoStars is a product of Suchhelden GmbH in Osnabrück. Contracting party, contact persons and data protection officer are based in Germany.
• Data in the EU: Server, database and error monitoring run in data centers in the EU, the database in Frankfurt.
• No training on customer data: We do not train any AI models on your data.
• Data processing agreement included: The DPA is public and is concluded together with your registration.
• All service providers disclosed: Every service provider that processes data is named in the DPA, including the AI and data providers.

Where your data is stored

• App server: Hostinger, data center in the EU.
• Database and login: Supabase, stored in the Frankfurt data center.
• Error monitoring: Sentry, stored in Frankfurt, without names and email addresses.
• Payments: Stripe. Card data never reaches our servers.

For the measurement, we send your prompts to AI services and data providers, partly in the USA. Only what the measurement needs goes there: prompt text, language, country and, where applicable, brand and domain. We do not transmit user accounts or email addresses. The basis is EU standard contractual clauses.

Access and roles

• Each project has its own roles: owner, editor and viewer. Viewers can only read; only the owner manages settings and members.
• Access rules directly in the database ensure that users only see projects they have been granted access to.
• Login sessions are stored in cookies that scripts in the browser cannot read.

Encryption

All connections to the website, the app and the API are encrypted via HTTPS. We store passwords only as a hash, never in plain text.

Availability and backups

• The database is backed up daily; backups are kept for seven days.
• The app and website are continuously monitored from the outside. In case of disruptions, we are notified automatically.
• We roll out updates without downtime: the new version is built while the old one keeps running, and we only switch over after a successful build.
• The status of the measurements per AI platform is shown on the public status page.

Deletion and export

You can retrieve your data at any time via the export functions. After the contract ends, you have 30 days to export; after that we delete the data, unless statutory retention obligations apply. We support switching to another provider in line with the EU Data Act.

The website

geostars.com does not load fonts, videos or analytics tools from third-party servers. Google Ads only runs if you consent. Details are in the privacy policy of the website.

Contracts and documents

• Data processing agreement (DPA) with list of sub-processors
• app privacy policy
• Terms and conditions

You can get a signed DPA or answers to your security questionnaire on request at Cookie settingshello@geostars.com.

Found a security vulnerability?

Write to us at hello@geostars.com with the subject "Security". We reply quickly and keep you updated on the fix.

Our data protection officer answers privacy questions: datenschutz@suchhelden.de.