ipbase is run by Everapi GmbH, a company under Austrian law, so the GDPR applies to everything we do. The API, the dashboard and the databases run on our own servers in Germany. This page shows how we protect the data you send us: what is in place today, where the data is kept and who processes it for us.
The API and the dashboard run on our own servers in Germany. Requests reach them through Cloudflare, which handles each request in one of its data centers, usually one near the caller; that data center can be outside the EU.
| Data | Where |
|---|---|
| Account data, usage data and request logs | Our servers in Germany (Hetzner) |
| Files you store with us, cached free tool answers and website pages | Cloudflare (R2 storage and global network) |
| Backups of our main database, encrypted | Backblaze, Netherlands (Amsterdam) |
| Details of failed requests (error tracking) | Sentry, United States |
| Website and dashboard analytics | PostHog, EU |
| Payments and invoices | Stripe, Ireland and United States |
| Support emails | Google Workspace, Ireland and United States |
hostname=1, we ask DNS for the address’s reverse DNS name. This query reaches public DNS servers, including those of the network operator the address belongs to.Our status page checks the API every minute. How long we keep each kind of data is in our privacy policy.
These service providers process personal data on our behalf when we provide the ipbase API and the dashboard at app.ipbase.com. Last updated: 28 October 2026.
| Provider | What it does for us | Personal data it may receive | Location |
|---|---|---|---|
| Hetzner Online GmbH | Servers for the API, the dashboard, our databases and our logs | All data described in our privacy policy, including what you send to the API | Germany |
| Cloudflare, Inc. | DNS, network proxy, encryption (TLS) and firewall for the API and the dashboard; hosting of this website and the free tools; bot protection (Turnstile); file storage (R2); delivery of contact form messages | Every request while it passes through, including what you send to the API; files stored for you; free tool lookups (cached for up to 7 days); contact form messages | United States, global network |
| Functional Software, Inc. (Sentry) | Error tracking for the API and the dashboard | Details of requests that caused an error | United States |
| PostHog, Inc. | Analytics for this website and the dashboard; recordings of dashboard sessions | Usage data and page addresses; in the dashboard, events linked to your account | EU (Germany) |
| Stripe | Payments and invoices | Billing details; card data goes to Stripe directly and never reaches our servers | Ireland, United States |
| Postmark (ActiveCampaign, LLC) | Sending account emails | Your email address and the content of the email | United States |
| Google (Google Workspace) | Our email, including support requests and contact form messages | Your messages and contact details | Ireland, United States |
| Anthropic, PBC | AI-assisted drafting of replies to support requests | Your message, its attachments and the account details needed to answer; not used to train models | United States |
| Slack (Salesforce, Inc.) | Internal notifications to our team | Account name, email address and summaries of support requests | United States |
| Backblaze, Inc. | Backups of our main database, encrypted on our servers before upload, kept for 14 days | Encrypted copies of our main database, including account data; Backblaze cannot read them | Netherlands (Amsterdam) |
We tell the account owner by email at least 30 days before a new sub-processor starts to process personal data. If you object for a reason related to data protection, you can end the affected service before the change; we refund fees you paid in advance for the time after it.
Download this list as CSV. Providers that only serve this website, such as font hosting, and the sign-in providers you can choose are named in our privacy policy.
We process your data in line with the GDPR. ipbase is run by Everapi GmbH, a company under Austrian law, so the GDPR applies to everything we do; the supervisory authority is the Austrian Datenschutzbehörde. The API, the dashboard and the databases run on our own servers in Germany, and every provider that processes personal data for us is on our public list of sub-processors.
No. ipbase has no SOC 2 report and no ISO 27001 certificate. This page lists the security measures that are in place today, where your data is kept and every sub-processor, and we review our code, dependencies and servers for security problems several times a year.
Account data, usage data and request logs are kept on our own servers in Germany (Hetzner). Requests reach them through Cloudflare, which handles each one in a data center usually near the caller, and Cloudflare's storage (R2) keeps the files you store with us. Encrypted backups of our main database are kept at Backblaze in Amsterdam, Netherlands.
In transit, end to end: HTTPS between you and Cloudflare, TLS with a checked certificate from Cloudflare to our servers, and TLS between our servers, databases, cache and log store. Database backups are encrypted on our servers before they leave them, and the backup provider has no key. Card numbers are entered at Stripe and never reach our servers.
Yes. You can protect your sign-in with an authenticator app and recovery codes, also when you sign in with Google, GitHub, GitLab or Microsoft. Owners and admins can require two-factor authentication for every member of their team.
Web server logs are deleted after about 14 days, the personal fields in request logs (request URL, IP address, user agent) after 90 days, and backups after 14 days. You can delete your account yourself at any time: your teams, API keys, subscriptions, webhooks and search history go with it, and invoices are kept for 7 years, as Austrian tax law requires.
No. We do not sell what you send to the API. The AI provider that helps us draft replies to support emails does not train on them.
Write to office@everapi.com. Security researchers also find this contact in /.well-known/security.txt on every one of our sites.