Compliance
A free tool that meets enterprise compliance
Let's Consent isn't just for hobbyists — it's built for businesses, SMBs and enterprises alike. Enterprises act globally, so Let's Consent enables global compliance: this page tells you exactly where your data lives, how long we keep it, and which regimes that satisfies.
🇩🇪 Fully made in Germany, hosted in the EU.
Our primary servers run in Germany, with encrypted backups replicated to Helsinki, Finland. Your data never leaves the European Union.
Server Location
All production systems run on Hetzner infrastructure in Germany. Encrypted backups are replicated to Hetzner's data center in Helsinki, Finland for disaster recovery.
Both locations are inside the European Union and subject to the GDPR. There are no transfers to third countries, no US cloud regions, and no "adequacy decision" fine print to reason about.
Primary
🇩🇪 Germany
Hetzner data centers
Backup
🇫🇮 Helsinki, Finland
Encrypted replicas, EU jurisdiction
Subprocessors
This is the complete list. Most vendors publish pages of subprocessors; ours fits in a table with two rows.
| Subprocessor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting & DNS | Germany / Finland (EU) |
| BunnyWay d.o.o. (BunnyCDN) | Content delivery network | EU (Slovenia) |
BunnyCDN, when used, serves static assets (the consent banner script and stylesheets) and may also process consent records and account data in transit as part of content delivery.
Data Retention
We keep data exactly as long as it is useful to you or required by law — and not a day longer.
Consent Logs
The retention period for consent logs needs to be at least as long as the period for which your business must back-proof legal compliance. Legal suits can be brought back for different time periods depending on your geographic location.
Consent data is retained for 6 years — long enough to satisfy every major regime: the EU requires at least 3 years, CCPA/CPRA requires 5 years, HIPAA 6 years, and UK GDPR 6 years.
| Regulation Name | Regional Baseline | Back-Proof Requirement | Directive / Statutory Section | Core Compliance Note |
|---|---|---|---|---|
| EU GDPR | At least 3 years | 3 to 6 years (depends on EU member state civil law timelines). | Article 7(1) (Conditions for consent) & Article 5(2) (Accountability principle). | Dictates that the controller must be able to demonstrate/prove the data subject gave consent for as long as processing occurs and during liability windows. |
| CCPA / CPRA | 5 years | 5 years (aligns with California's civil and enforcement limits). | Cal. Civ. Code § 1798.100(a)(3) & 11 CCR § 7101 (Record-keeping). | Explicitly prohibits storing personal data longer than "reasonably necessary", while record-keeping provisions require request logs to be kept for at least 24 months. |
| HIPAA | 6 years | 6 years from creation or when it was last in effect. | 45 CFR § 164.316(b)(2)(i) (Documentation retention standard). | Requires all signed patient authorizations, privacy notices, and consent logs to be persistent for a strict 6-year mandatory minimum. |
| UK GDPR | 6 years | 6 years (matches the UK civil litigation window). | Article 7(1) combined with the Limitation Act 1980 (Section 5). | Consent must be kept to defend against breach of contract or statutory duty claims, which expire 6 years after the event. |
Everything else
- Account data (your email address and organization membership) is kept for as long as your account exists. Delete your account and it is removed.
- Server logs are kept briefly for security and abuse prevention, then automatically deleted.
- Backups follow the same retention rules: expired data ages out of backups on a fixed schedule.
Information Security
If your organization runs an ISMS or is ISO 27001 certified, your supplier review will ask a predictable set of questions. This section answers them up front — we make it all public.
Data processing agreement (Art. 28 GDPR)
A data processing agreement covering our role as processor of your visitors' consent records is available to every account. It incorporates the subprocessor list above and our technical and organizational measures (TOMs).
Encryption
All traffic is encrypted in transit with TLS. Data is encrypted at rest, and backups — including the replicas in Helsinki — are encrypted before they leave the primary environment. There is no unencrypted path for consent or account data.
Access control
Access to production systems follows least privilege and is restricted to the operators who run the service, authenticated with strong, phishing-resistant credentials. Customer-side access uses passwordless email sign-in, so there is no password database to breach. Within an organization, every team member has an individual account — no shared credentials.
Roles & permissions
Every organization member holds one of three roles, so least privilege extends into your own team:
1. Owner
The Owner holds full control over the organization.
- Capabilities: Modify all compliance and banner settings, invite and manage users, assign user roles, and delete domain groups.
- Best for: Account owners, IT directors, or primary Data Protection Officers (DPOs).
2. Admin
The Admin is built for day-to-day configuration without giving full account sovereignty.
- Capabilities: Change compliance settings, edit cookie banner details, and generate compliance reports.
- Limitations: Cannot invite new users, change existing users' roles, or delete domains.
- Best for: Web developers, marketing teams, or privacy specialists.
3. Reader
The Reader is a view-only role for oversight and monitoring.
- Capabilities: View scan reports, check consent analytics, and view the current declaration and settings.
- Limitations: Cannot make any changes to the account, settings, or domains.
- Best for: External auditors, legal advisors, or stakeholders needing visibility.
Backups & disaster recovery
Automated, encrypted backups are taken on a fixed schedule and replicated to a geographically separate EU data center (Helsinki, Finland). Restores are tested. Because the consent banner script is served statically and cached, an outage of the core platform does not take consent collection on your website down with it.
Logging & monitoring
Production systems are monitored for availability and anomalies. Security-relevant events are logged; logs are retained briefly for investigation purposes and then deleted, consistent with our data retention rules above.
Vulnerability management & secure development
Systems are patched on a regular cadence, with expedited handling for critical vulnerabilities. Changes reach production through review and automated checks. We keep the dependency surface deliberately small — the same philosophy as our subprocessor list. Security reports are welcome at hi@letsconsent.eu.
Incident response & breach notification
Security incidents are triaged, contained, and documented. If an incident affects your data, we notify you without undue delay and with the detail you need to meet your own 72-hour notification duty under Art. 33 GDPR — what happened, what data was affected, and what we did about it.
Personnel & confidentiality
Everyone with access to production data is bound to confidentiality and trained on data protection. Access is revoked immediately when a role ends.
Exit: export & deletion
No lock-in: you can export your consent records in a machine-readable format at any time. When you delete your account, your data is deleted from production immediately and ages out of backups on the fixed schedule described under Data Retention.
Certifications
Let's Consent is not ISO 27001 certified — this would kill our budget. Instead, we keep our infrastructure extremely simple and report our technical controls. Our hosting provider, Hetzner Online GmbH, operates ISO 27001 certified data centers.
Penetration testing
We do not commission third-party penetration tests — like a certification audit, that would consume the budget that keeps this service free. Our answer is the same as above: an extremely small attack surface, transparently reported technical controls, and open arms for independent security research under the disclosure policy below. If your ISMS requires a pentest report from every vendor, we may not clear that bar — we'd rather tell you that here than after you've filed the paperwork.
Vulnerability disclosure policy
If you believe you've found a security vulnerability in Let's Consent, we want to hear about it. Report it to security@letsconsent.eu — this contact is also published machine-readably at /.well-known/security.txt (RFC 9116).
- We acknowledge reports within 5 business days and keep you informed as we work on a fix.
- Research conducted in good faith under this policy is welcome: we will not pursue legal action for it (safe harbor).
- Please avoid accessing other users' data, degrading the service, or social-engineering our operators; use test accounts where possible.
- Give us a reasonable window — 90 days — to remediate before public disclosure.
- We credit reporters who want to be credited. There is no bug bounty; the same budget honesty as everywhere else on this page applies.
Something your ISMS checklist asks that this page doesn't answer?
Ask us at hi@letsconsent.eu and we'll amend it here and notify you.
ESG
If your organization reports on environmental, social, and governance criteria, your supply chain is part of that report. Here is what adding Let's Consent to it means.
Carbon Footprint
Our data centers run entirely on renewable electricity, and our hosting provider, Hetzner Online GmbH, is EMAS certified (the EU's Eco-Management and Audit Scheme). Beyond the energy source, the same simplicity that keeps this service free keeps it light: a small infrastructure footprint means little compute, and little compute means a small carbon footprint.
Funding & Stewardship
A fair question about any free service: who pays for it, and will it still be here next year? The hosting costs are funded, and the project stewarded, by botBrains UG (haftungsbeschränkt), Osloer Str. 83, 13359 Berlin, Germany.
Because the infrastructure is deliberately simple and runs on Hetzner, the cost of keeping Let's Consent free is small and predictable — sustainability by frugality, not by a future paywall.