Ownership and data location
KVNest is EU-owned and runs in Germany. Here is who owns it, where your data is, who else handles it, and where that stops being true.
Last reviewed 5 November 2026
Who owns KVNest
KVNest is a brand of Kubenest.
Kubenest is the company you contract with and the controller of your account data. It is registered in Amsterdam, the Netherlands.
One owner, no US parent.
The company has a single owner. It has no US parent company and no outside investors.
Where your data lives
Every instance runs at Hetzner in Germany.
That holds for every plan, including the free one.
Account and instance data are stored there too.
Your account details and instance records are kept in Germany, not only the instances themselves.
Who else touches it
Hetzner Online GmbH hosts our servers.
It acts as our processor under a data processing agreement (Art. 28 GDPR).
Google and GitHub run the sign-in.
You use one of them to create an account, and each processes sign-in data as an independent controller under its own privacy policy.
Google Analytics runs only if you consent.
Without consent its script is never loaded.
Some of this can leave the EU.
Google and GitHub may process sign-in data, and Google may process analytics data if you consent, in the United States. Both participate in the EU-U.S. Data Privacy Framework. Section 5 of the privacy policy has the details.
Data processing terms.
If you store personal data in an instance, we process it only on your behalf. Those data processing terms are part of our Terms, and business customers can request a data processing agreement under Art. 28 GDPR.
What the CLOUD Act does and doesn't mean here
What it is.
A US parent is subject to the CLOUD Act: with a warrant, US authorities can require it to disclose data it controls, wherever that data is stored. Providers can challenge an order that conflicts with local law, but the risk stays with you.
What it means for KVNest.
KVNest has no US parent, so the most direct CLOUD Act route doesn't apply. That is not the same as no exposure: the US sign-in providers above are separate companies with their own obligations. This is not legal advice.
What we don't promise
No SLA.
Nothing about uptime is guaranteed in writing during the preview.
No certifications yet.
We hold no SOC 2 or ISO 27001 certificate and have had no independent security audit.
Sign-in goes through US providers.
You can only sign in with Google or GitHub today, so that part of your data is handled outside our control.