The short version
Your data is yours. It lives in the EU. You can see it, export all of it yourself, and leave with it. And because the core of Conzent is open source under Apache 2.0, your exit does not depend on our cooperation, our pricing, or our continued existence. That is not a contract clause - it is an architecture we cannot revoke.
What we store
For your account: your login details (passwords stored only as bcrypt hashes), company information, your sites and their banner, cookie and policy configuration. For your visitors: consent records - which choices were made, when, on which domain, with the consent strings needed as proof. The complete database schema is public in our open-source repository, so "what do you store" is never a question you have to take our word for: you can read the exact table definitions our platform runs.
What we deliberately do not store
Consent logs do not contain raw IP addresses. Visitor IPs are pseudonymized the moment a consent record is written - a keyed hash that keeps records correlatable for audit purposes without storing the address itself. Password hashes and session tokens never leave the system, not even in your own exports.
Where your data lives
Conzent is operated by Conzent ApS, a Danish company. Customer data is hosted on Hetzner infrastructure in the EU (Germany and Finland). Static consent scripts are delivered through Cloudflare's edge network; your consent database never leaves EU hosting.
One exception, stated plainly rather than left for you to discover: transactional email - password resets, scan alerts and the reports you schedule - is sent through Amazon SES in the United States, so the recipient address and the message itself cross the Atlantic. That transfer relies on Amazon's certification under the EU-US Data Privacy Framework and the standard contractual clauses in their data processing agreement. Your consent records are not involved and do not leave the EU.
Seeing what happens on your account
Every state-changing action on your account - configuration edits, cookie changes, banner updates, exports - is recorded in an append-only audit trail you can read yourself in the dashboard under Account, Activity: what happened, when, and from which IP address. Consent records themselves are append-only by design: nothing in the dashboard can edit or rewrite a recorded consent.
Exporting your data
Two ways, both self-serve. Consent logs export to CSV directly from the dashboard, filtered by date and status - built for the day a supervisory authority asks you for records. And under Account, Your Data, one click generates a complete export of everything we hold for you - every table, delivered as structured files with a manifest, downloadable the moment it is ready. The export uses the same public schema as the open-source core and imports directly into a self-hosted Conzent OCI installation with a single command (account:import) - websites, banners, cookie configuration, policies and your full consent history, with your embed keys preserved so your sites keep working.
Leaving
You can leave at any time, for any reason, with everything. Your complete export restores into software you can run yourself, free, under Apache 2.0 - the same core our cloud runs. After you leave, we delete our copy on request and confirm it in writing. We would rather earn your renewal than rely on your lock-in.
Retention
Consent records are kept as proof of consent for as long as you need them. By default, records older than three years are deleted automatically each night; the window is configurable per installation, including keeping records indefinitely. Whatever window you choose, deletion is automated rather than something you have to remember.
Signing in
Two-factor authentication is available on every account. Scan a QR code with any authenticator app - Google Authenticator, 1Password, Bitwarden, Authy - and sign-in needs a code as well as a password. You get ten single-use recovery codes for the day the phone goes missing, and you can trust a device for 30 days so you are not asked on every visit.
Two details that matter more than the feature itself. Shared secrets are encrypted at rest, so a database compromise does not hand over everyone's second factor. And on our cloud, an administrator can never use account impersonation to step around a customer's two-factor: impersonation is refused unless the administrator has satisfied their own, which means turning it on genuinely raises the floor rather than only inconveniencing you.
Security
Passwords are stored as bcrypt hashes. Every write action requires an authenticated session scoped strictly to your own account. The consent runtime fails closed: if our infrastructure has a problem, blocked scripts stay blocked on your site - an outage on our side never becomes a compliance breach on yours. It cannot lose a consent record either: choices made while the service is unreachable are stored in the visitor's browser and delivered exactly once when it is back, stamped with the time the consent actually happened. And because the core is open source, your security team can audit the actual code that processes your data.
Reporting a vulnerability: our security contact is published as a machine-readable security.txt in the RFC 9116 format, and our disclosure policy sets out what happens after you send it - acknowledged within two business days, assessed within five, with a remediation plan and a named point of contact rather than a ticket number. Please do not open a public issue for a security report: our core is open source, so a public report is a working exploit handed to everyone running it.
Accessibility
The consent banner meets WCAG 2.1 AA: keyboard operation throughout, correct dialog semantics for screen readers, visible focus, labelled controls, and default colors that pass contrast requirements. This is verified, not asserted: every built-in layout runs through automated axe-core accessibility tests on every release and every night, and the banner settings warn you when your own brand colors would fall below the AA contrast threshold. Your accessibility statement can cite the verification method, not just the intent.
Backups and continuity
The database is backed up nightly to independent off-site storage. And the deepest continuity guarantee is structural: if Conzent ApS disappeared tomorrow, your export plus the public open-source core keep your consent management running without us.
Subprocessors
We keep the list short: Hetzner (EU hosting), Cloudflare (content delivery), Amazon Web Services SES (transactional email, United States - see above), Stripe (payment processing). We do not sell data, share it with advertisers, or use it for anything beyond providing the service.
One more name, disclosed because we would rather you read it here than find it later. The credentials our mail sender authenticates with are held in endpointr, a credential vault operated by SitePoint Systems ApS - a separate company under the same ownership as Conzent ApS. It holds credentials, not your data: message content and recipient addresses go to the mail provider and never pass through it. Strictly it is not a processor of anything belonging to you, which is why it is named here rather than in the list above. We name it because an undisclosed related party is worse than a disclosed one.
Enterprise agreements
For enterprise customers we offer data processing agreements, defined support response times, and deployment reviews - including fully self-hosted setups where your data never touches our infrastructure at all. See Conzent for enterprise or talk to us.