Data residency

Because acnova.eu is proxied through Cloudflare, public IP lookup services display an IP address that belongs to Cloudflare, Inc. Such services may then show the United States or another Cloudflare location as the “server location”.

This Cloudflare IP address is the public security and edge endpoint of the service. It does not identify the physical location of Acnova's origin servers or of persistent application storage, which are in Helsinki, Finland.

Cloudflare, Inc. is a US-based company with a worldwide network. An individual request is normally handled by the Cloudflare edge location closest to the visitor — for visitors in Europe this is typically a European edge location — before it is forwarded over an encrypted connection to Acnova's origin in Helsinki.

1. Visitor
   Browser or application anywhere in the world
3. Cloudflare global edge
   DNS · DDoS protection · WAF · CDN
4. Encrypted connection to the origin
5. Acnova infrastructure — Helsinki, Finland
   Application · database · file storage

A. Persistent application data and origin infrastructure — Helsinki, Finland

Application servers, databases, uploaded documents and files, product media and the search index of the platform behind acnova.eu are hosted on Acnova's infrastructure in Helsinki, Finland. Customer accounts, orders, invoices and other business records are stored there. Backup copies are kept in Finland.

B. Cloudflare edge and security processing

Cloudflare terminates the encrypted connection and inspects each request on its global network in order to filter attacks, enforce the web application firewall and deliver content quickly. In doing so Cloudflare processes connection metadata such as the visitor's IP address and request headers. Static, non-personal content (scripts, stylesheets, fonts, public product images) may be cached at Cloudflare edge locations around the world. Cached content is not persistent Acnova customer data. Details on Cloudflare as a processor, including transfer safeguards, are set out in the Privacy Policy.

C. Third-party services

Certain functions rely on specialised providers described in the Privacy Policy — for example payment processing (Stripe), e-mail (Google Workspace), parcel carriers and the AI assistant Hanna (Anthropic). Data shared with such a provider is processed under that provider's terms and the safeguards described in the Privacy Policy, including where the provider processes data outside Finland or outside the EU/EEA.

Privacy Policy

We do not claim that no data ever leaves Finland. Cloudflare's edge processing and the third-party services listed above may involve processing outside Finland or outside the EU/EEA. The legal basis for each transfer and the safeguards applied are described in the Privacy Policy. This page is an informational statement by Acnova Oy and not a certification.

Technical readers can check the statements on this page themselves:

DNS resolves to Cloudflare addresses; the origin is not exposed:

dig +short acnova.eu
# → Cloudflare anycast addresses, not the origin

Every response carries informational headers that state the origin region and the edge provider:

curl -I https://acnova.eu
X-Acnova-Origin-Region: Helsinki-FI
X-Acnova-Data-Residency: Helsinki-FI
X-Acnova-Edge-Provider: Cloudflare

A machine-readable summary is published at Acnova's own transparency endpoint (this is not an industry standard):

curl https://acnova.eu/.well-known/data-residency

Machine-readable endpoint

The headers and the endpoint are statements published by Acnova Oy; they are maintained together with this page.