The short version
Your data is yours. It lives in the EU. You can see it, export all of it yourself, and leave with it. And because the core of Conzent is open source under Apache 2.0, your exit does not depend on our cooperation, our pricing, or our continued existence. That is not a contract clause - it is an architecture we cannot revoke.
What we store
For your account: your login details (passwords stored only as bcrypt hashes), company information, your sites and their banner, cookie and policy configuration. For your visitors: consent records - which choices were made, when, on which domain, with the consent strings needed as proof. The complete database schema is public in our open-source repository, so "what do you store" is never a question you have to take our word for: you can read the exact table definitions our platform runs.
What we deliberately do not store
Consent logs do not contain raw IP addresses. Visitor IPs are pseudonymized the moment a consent record is written - a keyed hash that keeps records correlatable for audit purposes without storing the address itself. Password hashes and session tokens never leave the system, not even in your own exports.
Where your data lives
Conzent is operated by Conzent ApS, a Danish company. Customer data is hosted on Hetzner infrastructure in the EU (Germany and Finland). Static consent scripts are delivered through Cloudflare's edge network; your consent database never leaves EU hosting.
Seeing what happens on your account
Every state-changing action on your account - configuration edits, cookie changes, banner updates, exports - is recorded in an append-only audit trail you can read yourself in the dashboard under Account, Activity: what happened, when, and from which IP address. Consent records themselves are append-only by design: nothing in the dashboard can edit or rewrite a recorded consent.
Exporting your data
Two ways, both self-serve. Consent logs export to CSV directly from the dashboard, filtered by date and status - built for the day a supervisory authority asks you for records. And under Account, Your Data, one click generates a complete export of everything we hold for you - every table, delivered as structured files with a manifest, downloadable the moment it is ready. The export uses the same public schema as the open-source core and imports directly into a self-hosted Conzent OCI installation with a single command (account:import) - websites, banners, cookie configuration, policies and your full consent history, with your embed keys preserved so your sites keep working.
Leaving
You can leave at any time, for any reason, with everything. Your complete export restores into software you can run yourself, free, under Apache 2.0 - the same core our cloud runs. After you leave, we delete our copy on request and confirm it in writing. We would rather earn your renewal than rely on your lock-in.
Retention
Consent records are kept as proof of consent for as long as you need them. Retention is configurable per installation, with automated deletion of records older than your chosen window.
Security
Passwords are stored as bcrypt hashes. Every write action requires an authenticated session scoped strictly to your own account. The consent runtime fails closed: if our infrastructure has a problem, blocked scripts stay blocked on your site - an outage on our side never becomes a compliance breach on yours. And because the core is open source, your security team can audit the actual code that processes your data. Suspected vulnerabilities: email support@getconzent.com with "security" in the subject and we will respond ahead of everything else. Please do not open public issues for security reports.
Backups and continuity
The database is backed up nightly to independent off-site storage. And the deepest continuity guarantee is structural: if Conzent ApS disappeared tomorrow, your export plus the public open-source core keep your consent management running without us.
Subprocessors
We keep the list short: Hetzner (EU hosting), Cloudflare (content delivery), Amazon Web Services SES (transactional email), Stripe (payment processing). We do not sell data, share it with advertisers, or use it for anything beyond providing the service.
Enterprise agreements
For enterprise customers we offer data processing agreements, defined support response times, and deployment reviews - including fully self-hosted setups where your data never touches our infrastructure at all. Talk to us.