Hosting & Data Residency
Hosting, data residency and GDPR
DecisionOS by nexalign runs on dedicated servers in Germany. AI processing and content delivery involve US providers under standard contractual clauses. Full sub-processor list, Art. 28 DPA in place.
Hosting location
The application, its databases, the self-hosted analytics and all backups run on dedicated servers in Germany operated by a European provider, under an Art. 28 GDPR data processing agreement. There is no hyperscaler, no US fallback and no cross-border replication of stored data. Two steps do leave the EU: traffic is delivered through Cloudflare, which terminates TLS in front of the origin, and the AI features run through OpenAI in the USA, with vendor research additionally using Perplexity and Linkup. All of the AI steps carry case content: memos, document extraction and research alike work on what you entered, so where you describe your decision in your own words, that text is part of the request. These transfers rest on EU standard contractual clauses. Whether a given workload can accept them is a question we would rather you decide with the facts than discover later.
Sub-processors
European hosting provider (Germany): Servers, databases, backups. Can carry case content. Cloudflare (USA, global edge): DNS, TLS termination, content delivery. Can carry case content. OpenAI (USA): Memo generation, extraction, document analysis. Can carry case content. Perplexity, Linkup (USA): Vendor research, queries include your description of the decision. Can carry case content. Resend (USA, EU-US Data Privacy Framework): Transactional email. No case content.
GDPR compliance
An Art. 28 GDPR data processing agreement is in place with the hosting provider. Analytics uses a self-hosted Umami instance running on the same German infrastructure. Emails are sent transactionally via Resend under the EU-US Data Privacy Framework. There is no Google Analytics, no Meta pixel and no third-party cross-site tracking. Google Fonts are embedded locally so no client data is exchanged with Google during page load. Transfers to the US sub-processors named above rest on EU standard contractual clauses.
Sovereign cloud eligibility
The hosting stack qualifies: dedicated servers in Germany, European provider, no hyperscaler. The open point for a strictly sovereign scope is AI processing, which currently runs via OpenAI in the USA. OpenAI EU data residency is a configuration change on our side rather than a rearchitecture, so tell us if your scope requires it and we will confirm what we can commit to in writing.
Customer assurances
Enterprise customers receive: a full DPA under Art. 28 GDPR, a technical and organisational measures (TOM) document, a hosting-architecture diagram and information on data subject rights processes. These are shared under NDA during procurement.
Not to be confused with
Other products share parts of the name DecisionOS but are hosted differently or not in the EU. DECISO (deciso.io), DecisionRules (decisionrules.io), Decisions.com, iCustomer Decision OS (icustomer.ai), DecisionOps (aidecisionops.com), DecisionOS App (decisionos.app) and DecisionOS by PhysicsX (decisionos.ai) are all unrelated products. Only DecisionOS by nexalign (nexalign.io) is operated from Germany under the arrangement described on this page.