Table of contents
1. About this page
This page describes where the infrastructure of the portal and the ModbusCloud Gateway runs, which jurisdiction it is subject to and how ModbusCloud handles requests from governments for access to data. Articles 28 and 32 of the Data Act (Regulation (EU) 2023/2854) require this. The terms and conditions refer to this page in clause 8.6.
ModbusCloud is established in the Netherlands and is subject to Dutch law. Which data each provider processes, and with which safeguard, is on the list of sub-processors. Which data the gateway and the portal generate is set out in the Data Act information.
2. Where the service runs
| Component | Provider | Data centre | Location |
|---|---|---|---|
| Measurement data, new storage now being phased in | ClickHouse, Inc. (US), service ClickHouse Cloud | Google Cloud, region europe-west4 | Eemshaven, the Netherlands |
| Accounts, settings and measurement data | Supabase Pte. Ltd. (Singapore) | Amazon Web Services, region eu-west-1 | Dublin, Ireland |
| Portal (server functions) | Vercel Inc. (US) | Vercel, region dub1 | Dublin, Ireland |
| Backend | Railway Corporation (US) | Railway, region EU West | Amsterdam, the Netherlands |
| MQTT broker (connection to the gateway) | EMQ Technologies Incorporated (US), service EMQX Cloud Serverless | Amazon Web Services, region eu-central-1 | Frankfurt, Germany |
The new storage for measurement data is on the list of sub-processors as an announced sub-processor, with the earliest date on which ModbusCloud starts using it. The other announced providers, such as for the archive of measurement data, are listed there too.
In addition to the components above, ModbusCloud uses these supporting services.
| Purpose | Provider | Location |
|---|---|---|
| Website and webshop (server functions) | Vercel Inc. (US) | US (Washington). Orders and accounts are stored with Supabase in Ireland |
| Sending email, such as alert emails and sign-in links | Plus Five Five, Inc. (US), service Resend | US |
| Email to and from ModbusCloud, and signing in with a Microsoft account | Microsoft Ireland Operations Limited (Ireland) | EEA |
| Signing in with a Google account | Google Ireland Limited (Ireland) | EEA |
| Language model for the automation chat and the AI dashboard builder | Anthropic Ireland, Limited (Ireland) | US, processing elsewhere possible |
| Search in the template library | OpenAI Ireland Ltd. (Ireland) | US |
| Address autocompletion | KEPTAGO LTD (Cyprus), service Geoapify | EU |
| Remote management of the gateway, for support and maintenance | ZeroTier, Inc. (US) | US |
| Mobile data connection of gateways with a ModbusCloud SIM card | wherever SIM GmbH (Germany) | Germany |
| Payments in the webshop | Stripe Payments Europe, Limited (Ireland) | EEA |
| Bookkeeping and invoices | MoneyBird B.V. (the Netherlands) | The Netherlands |
3. Which jurisdiction the infrastructure is subject to
The data centres in the first table are in the EU and are subject to the law of the EU and of the country where they are located. Four of the five providers in that table are US companies. Supabase Pte. Ltd. is established in Singapore. The data centres of Supabase, ClickHouse Cloud and EMQX Cloud belong to Amazon Web Services and Google Cloud, also US companies.
As a result, US law may apply to these providers in addition to EU law. For example, a US government can require a US company under the CLOUD Act to hand over data it controls, even if that data is stored in the EU. ModbusCloud takes the measures in sections 4 and 5 against that risk.
4. Measures
| Measure | What it means |
|---|---|
| EU regions only | Measurement data, accounts and settings are stored only in data centres in the EU. They do not go to a country outside the EU for storage |
| Encrypted in transit | Traffic between the gateway, the broker, the backend, the database and the portal runs over TLS |
| Encrypted at rest | The providers encrypt the data they store |
| Least privilege | Only those who need access to systems and data for their task get it, with the smallest permissions that work. Each organisation sees only its own data, enforced in the database |
| Policy for requests | ModbusCloud follows the steps in section 5 for every request from a government |
For a few supporting services, limited data does go to the US, such as email through Resend and questions to the language model. Which data that is, is on the list of sub-processors.
5. Requests from governments
| Step | What ModbusCloud does |
|---|---|
| Only on a valid order | ModbusCloud only hands over data on an order that is legally valid. ModbusCloud follows an order from a government outside the EU only if it is based on an international agreement, such as a mutual legal assistance treaty, or meets Article 32(3) of the Data Act |
| Check | ModbusCloud checks whether the order is valid and whether the authority is competent |
| Challenge | If a request is broader than necessary or not in order, ModbusCloud challenges it |
| As little as possible | ModbusCloud hands over only the data the order strictly requires |
| Inform the customer | ModbusCloud informs the customer of the request, unless the law forbids it |
Questions about this page can be sent to info@modbuscloud.com.
6. Changes
| Date | Change |
|---|---|
| 15 October 2026 | Page published |