Data protection

Processing videos the GDPR way: storage and rendering in the EU

For agencies and teams that have their clients' videos processed: where the files are, where rendering happens, what does not happen to them and how to check a video tool on this question. This is not legal advice.

Where your videos are and where rendering happens

The files sit in Hetzner's object storage in Nuremberg, and the database on the FrameJet server at the same location. The provider, KoperaLabs, is based in Germany.

Rendering runs on the server in Nuremberg. Under heavy load, more servers join for a short time, and only in Falkenstein or Helsinki: The program limits the choice to these three locations.

At startup, FrameJet checks the storage endpoint. If it is not with an EU provider or on the own network, the application does not start. That is a safeguard against configuration mistakes, not a certificate.

Certified data centers

Hetzner states that its data centers in Nuremberg, Falkenstein and Helsinki are certified to ISO/IEC 27001. The current certificate and its term are on the Hetzner page. The certificate belongs to Hetzner and covers its operation, not FrameJet.

What changes with video tools that have servers in the USA

If a provider processes videos on servers in the USA or through a company there, that can be a transfer to a third country. That needs a legal basis; for US providers it is often the EU-US Data Privacy Framework.

Its adequacy decision is currently in force. An appeal was lodged against the EU General Court's judgment that dismissed a challenge to it; check the current status yourself. If you have videos processed in the EU, you do not depend on how that ends.

With FrameJet there is no such transfer for the videos: storage and processing take place in Germany and Finland.

No use for AI training

FrameJet uses videos only to create the versions you ordered. It does not train AI models with them and does not use them for advertising. Today FrameJet has no AI feature that sends videos to third parties.

What does not stay with FrameJet

Payments run through Stripe, the seller under Stripe Managed Payments. Card data never reaches FrameJet. How Stripe processes data is described in the privacy policy and in Stripe's own notices.

Deletion and contract

On the free plan, FrameJet deletes videos and exports automatically after 7 days. You can delete a workspace; after 30 days of grace, everything is removed. You can read the data processing agreement beforehand and sign it in the settings: view the agreement.

How to check a video tool

Where are the files, and where does rendering happen?
Is there a data processing agreement you can read beforehand?
What happens to the videos: only the processing you ordered, or training and analysis too?
When and how are videos deleted?
Which other service providers see the data, and where are they based?

One more step to the finished video? Work out how much of the picture stays in each format: aspect ratio calculator.

Aspect ratio calculator

Process videos in the EU

Try it free and read the contracts beforehand.

Start for free

Frequently asked questions

Is FrameJet GDPR compliant?

Whether using it in your company is GDPR compliant depends on your case and is your assessment, with your data protection officer if needed. FrameJet provides storage in the EU, a data processing agreement and fixed deletion periods for it.

Do I need a data processing agreement?

Usually yes, if people can be recognised in the videos or you otherwise have personal data processed. If in doubt, ask your data protection officer.

Where do additional servers run?

Only in Falkenstein and Helsinki, in addition to Nuremberg. They are deleted again after use.

Are my videos used for AI training?

No. Videos serve only the processing you ordered.

Is there a transfer to third countries?

Not for the videos. Payments run through Stripe; what that means for your data is in the privacy policy.