Honestly: the convenient path would have looked different. An AWS account, Cloudflare in front, a Vercel deploy, done. That is how most teams build today, and we understand every one of them. The tooling is mature, the docs are good, everything moves fast.

We decided against it anyway. There is not a single US provider anywhere in fastmon’s data path. No Cloudflare, no AWS, no GCP, no Vercel. Why we put ourselves through this, and what it concretely changes for your data: that is what this post is about.

“EU hosting” is printed on everything now

Most tools that call themselves privacy-friendly are US companies with a data center in Frankfurt. The servers sit in Europe. The company still answers to US law, and the US CLOUD Act reaches its data wherever it lives. An EU region is simply not the same as EU jurisdiction.

That is the difference between a tool from the EU and one with an EU region. And that is exactly where we did not want to end up.

What actually sits behind ours

fastmon labs UG is a German company from Hannover. All customer and monitoring data is processed exclusively in the EU and stored in Germany: Hetzner, Falkenstein data center.

And the rest? European too, all the way through. A few examples from our provider list:

Hosting, storage and backup: Hetzner, Germany
Ingress: a company from Berlin
DNS: a provider from Slovenia
Transactional and business email: two providers from the Netherlands
AI inference: Mistral AI from Paris, and only if you actively opt in

Nine sub-processors in total, five of them based in Germany, the rest in the EU. The full list is not something you negotiate out of a sales call, it sits publicly in our DPA.

And full transparency, because the question will come up eventually: for our internal toolkit we do use US tools. Our code lives on GitHub, tickets run through Linear, and Claude Code from Anthropic helps us build. The difference: no customer and no monitoring data flows through any of them, our internal policy forbids exactly that, and that is why these tools are not sub-processors. We list them openly on our provider page anyway. The data path, meaning everything that touches your data and your visitors’ data, stays in Germany and the EU.

The CLOUD Act, without the drama

The US CLOUD Act obliges US companies to hand over data, no matter where their servers stand. That is why the Frankfurt region does not help. At fastmon, no provider in the data path is subject to US law; access under it is therefore not something to expect.

We deliberately claim no more than that. Law is not a switch you flip once, and words like “impossible” have no place in a data path. But the starting position is fundamentally different when no party involved answers to a US order.

What actually reaches your data

Jurisdiction is one half. The other half is what gets collected in the first place. There we rely on architecture instead of promises:

Your visitors’ IP is reduced to a country code at the edge, just the country, ISO-2, and discarded immediately. No raw IP and no User-Agent ever reaches the backend.
In the default mode, fastmon sets no cookies* and stores nothing on the device.
No fingerprinting, no cross-site identifiers, no third-party enrichment.

The asterisk behind “cookies” is deliberate, by the way. Cookie-free does not automatically mean consent-free. More on that in a moment.

The part nobody can take off your plate

Now the uncomfortable part that many vendors like to leave out. Whether embedding an analytics tool requires consent under § 25 TDDDG, Germany’s implementation of the ePrivacy rules, is disputed. The strict reading, which Germany and the EDPB lean towards, treats analytics and performance measurement as not strictly necessary. We assume exactly that strict reading and build and document conservatively.

In plain terms: in most cases you will still need a consent banner with fastmon. You obtain that consent as the site operator through your consent tool, and that responsibility stays with you. The assessment for your own site is yours to make, ideally together with your data protection officer. A tool that gives you a blanket all-clear here is exactly the kind of tool you should question.

Note: This is not legal advice. It describes how fastmon is built and documented; the assessment for your specific setup is yours.

Why we put ourselves through this

Because the product would not be credible otherwise. A monitoring tool that promises privacy and then ships the data through US clouds would be exactly the fine print we criticize above.

The path is less convenient, we will admit that openly. Fewer ready-made building blocks, more running things ourselves, and with every new provider the first question is: are they based in the EU? But honestly: the European providers we work with are not a compromise. They are just not the default.

Maybe that is exactly what should change.

Everything here is laid out in more detail, with every number and every provider, on our EU & Privacy page.