Confidential Region

Germany (Confidential) is an isolated region for applications and databases that process data subject to professional secrecy under § 203 of the German Criminal Code (StGB), for example client data handled by lawyers or tax advisors.

The region runs on separate hardware in Falkenstein, Germany, with its own private network and gateways. Only dedicated CPU servers are available.

Get access

The team owner signs the Confidential Data Agreement:

1. Open Team > Compliance in the dashboard.
2. Read the agreement, confirm your company name and address, and sign.
3. Select Germany (Confidential) when you create a server or database.

There is no separate approval step. The signed agreement can be downloaded from the same page at any time.

If we make a material change to the agreement, the owner has to sign again before the team can create new resources in the region. Existing servers and databases keep running.

What the agreement covers

By signing, Sliplane binds itself to secrecy under § 203 StGB. Our staff with access to the region and our infrastructure provider, Hetzner Online GmbH, are bound the same way.

Covered:

• Your applications on servers in the region, including their volumes.
• Managed PostgreSQL databases in the region.
• Backups of these volumes and databases. They are encrypted before they leave the region, and the storage provider has no access to the unencrypted data.

Not covered:

• Logs. Everything your app writes to stdout or stderr is stored outside the region.
• Builds. The build pipeline runs outside the region. This includes your source code, Docker image, build arguments and build logs.
• Environment variables. They are stored encrypted in our control plane and passed to the build.
• Object storage. S3 buckets are not part of the region.

Your checklist

• Never write secret data to logs.
• Keep secret data out of your repository, Docker image and build arguments.
• Do not store secret data in environment variables. Use them for configuration only.
• Encrypt data on the client side before you upload it to object storage, and keep the keys to yourself.
• Encrypt secret data on the client side wherever it is technically feasible.

Limits

• No C5 attestation. Sliplane does not hold a BSI C5 attestation. Medical practices, hospitals, pharmacies and their processors that fall under § 393 SGB V must not process social or health data in this region.
• Check your own rules. You decide which data you process and stay responsible for the professional secrecy obligations that apply to you, for example under BRAO, StBerG or BNotO. This page is not legal advice.