Schrems II, the CLOUD Act and where SilentChat processes your data
Since the Schrems II ruling of 2020, transferring personal data to the US needs justification; the CLOUD Act obliges US providers to hand over data even when it is stored outside the US. That's why SilentChat processes chat data only with German providers. The only US link in regular operation is payment processing via Stripe.
What Schrems II decided
On 16 July 2020, the Court of Justice of the EU declared the EU-US Privacy Shield invalid in case C-311/18 (press release). Standard contractual clauses remained valid — with the duty to check whether they are actually effective in the recipient country.
On 10 July 2023, the European Commission adopted a new adequacy decision for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795). The General Court dismissed an action against it in September 2025 (T-553/23).
What the CLOUD Act means
The US CLOUD Act of 2018 obliges US providers to disclose data in their possession, custody or control — regardless of where it is stored (18 U.S.C. § 2713). A data centre in Frankfurt doesn't change that if the operator is a US company.
How SilentChat is set up
Only German providers process our chat data:
- Hetzner runs the application, the database, the website and the widget.
- Strato stores the encrypted backups.
- IONOS provides the AI models — for answers and for knowledge base search.
Two kinds of processing involve no provider at all: voice messages are transcribed by our own service on our server, and reading answers aloud happens in the visitor's browser.
There are two US links: Stripe processes payments and receives billing data for that, no chat content. And anyone who signs in with their Google account uses Google for it.
What changed before launch
This setup wasn't like this from day one, and that belongs in the picture:
- 13 August 2026: until then, the vectors for the knowledge base were computed by OpenAI in the US. Since then IONOS computes them in Germany; knowledge bases were rebuilt for the switch.
- 19 August 2026: the application moved to Hetzner.
- 14 September 2026: we switched off the Cloudflare proxy in front of our website — Cloudflare wasn't on any of our lists.
Technically, the application still has connectors for US AI providers; in production, only IONOS is active today. If a subprocessor were added, we would announce it at least 30 days in advance as set out in the data processing agreement.
The full list is under Security → Subprocessors. This article is not legal advice.