Answer
For hosted customer projects, schukai publicly describes possible infrastructure and processing frameworks. The specific storage location and the subcontractors used depend on the product and the agreed operation. As a rule, it is defined for each engagement which personal data is processed and which services are necessary.
A data processing agreement under Article 28 GDPR is required if schukai processes personal data on behalf of the customer. With purely local or self-hosted software, such a role does not arise automatically; support access or other services may nevertheless trigger it. Special categories of personal data are not tacitly assumed but must be explicitly classified. This answer helps with preparation. It does not replace a specific data protection and contract review.
As of 3 September 2026
Further reading
Related topic: Technology and operations