Where your LoRaWAN data sits
and who can touch it.
This page answers the questions a compliance review asks, with the answers we can actually evidence. Including the places where the answer is less polished than marketing material makes it sound.
- Eight regions, Germany as the default
- Data processing agreement under Article 28 GDPR
- Dedicated instance instead of shared tenancy
- Data export and migration at any time
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.
Data locations by region
Sensor data, device metadata and configuration do not leave the region you choose. That includes backups.
| Region | Legal framework | Third-country transfer |
|---|---|---|
| Germany | GDPR, German law | None |
| Netherlands | GDPR, Dutch law | None |
| USA | US law | Yes, own legal basis required |
| Canada | Canadian law | Yes, own legal basis required |
| Singapore | Singapore law | Yes, own legal basis required |
| Japan | Japanese law | Yes, own legal basis required |
| Australia | Australian law | Yes, own legal basis required |
| India | Indian law | Yes, own legal basis required |
Germany is the default region. For customers based in the EU, Germany and the Netherlands are the two regions without a third-country transfer. For all others, choosing a region is a compliance decision you should take deliberately and document.
Data center certifications
Germany is the standard location. Other locations and their operating conditions are assessed on request before quoting. Location, backup destinations and responsibilities are documented.
What chirphost is responsible for
These are the parts we are responsible for ourselves, and the parts we document for your own certification.
Dedicated instance instead of shared tenancy
Every customer gets their own instance with their own database. Separating your data from other customers' is therefore a question of infrastructure, not of tenant logic inside a shared application.
Encryption in transit
TLS for the web interface and the APIs, TLS with certificates for gateways over Basics Station. LoRaWAN itself adds encryption at network and application layer all the way into the device.
Patch cycles
ChirpStack, operating system, PostgreSQL, Redis and the MQTT broker are maintained. Security-relevant updates are pulled forward rather than batched.
Access control
Administrative access to your instance is performed by WZ-IT from Germany. Who accesses it under which conditions is set out in the data processing agreement, not left to chance.
Backups
Automatic backups, kept in the same region as your instance. There is no replication into another jurisdiction.
Monitoring
What is monitored is availability and system metrics. Your sensor payloads are not analysed for that purpose.
Processing on your behalf
In operating your instance you are the controller and WZ-IT is the processor. A data processing agreement under Article 28 GDPR is part of every plan. It covers subject matter, duration, nature and purpose of the processing, the categories of data subjects and the technical and organisational measures.
One point that often gets missed: LoRaWAN telemetry looks anonymous and frequently is not. As soon as a sensor can be mapped to a meter, an apartment, a vehicle or a person, personal data is involved, regardless of how harmless the reading itself looks. Consumption data from submetering and position data from asset tracking are the two cases underestimated most often in practice.
Data ownership and exit
ChirpStack is MIT licensed. That is the practical core of data ownership: your instance is not a proprietary black box but a standard installation you could keep running yourself. Device profiles, codecs, tenant structure and integrations are portable.
A full export of your data is available at any time, not only at the end of the contract and not only as time-limited API access. There is Setup according to agreed scope and no minimum term making a move artificially expensive. The EU Data Act strengthens exactly this position for cloud customers; we implement it regardless.
Third countries and the CLOUD Act
Six of the Germany; other locations on request sit outside the EU. Choosing one of them means exporting personal data to a third country, which requires its own legal basis under Chapter V GDPR, usually standard contractual clauses together with a transfer risk assessment. That is workable, but it is work, and the work sits with you as the controller.
The US CLOUD Act applies to US companies and obliges them to hand over data they control, even when the servers are in Europe. It bites not through where a data center stands but through who controls the provider. WZ-IT is a German company with no US parent. For the German and Dutch regions there is therefore neither a third-country transfer nor a corporate structure that could trigger access under US law.
If your devices sit in North America or Asia and latency is decisive, a region there is still the right call. The point is simply that the decision should be made deliberately and documented, rather than falling out of a default in the checkout.
Read on
Rent a LoRaWAN network server
What operations cover, which engine runs and how the Germany; other locations on request differ.
EU Data Act and data ownership
Who owns the data from connected devices and which switching rights the Data Act gives cloud customers.
From TTN to your own instance
Migration guide covering session preservation, gateway cutover and the points where it typically stalls.
Frequently asked questions about security and data protection
Is chirphost GDPR-compliant?+
When operated in the German or Dutch region, all sensor data, device metadata and configuration stay inside the EU, so there is no third-country transfer to justify, and a data processing agreement under Article 28 GDPR is provided on request. GDPR compliance is ultimately a property of your entire processing operation, though, not of the hosting alone: legal basis, purposes, retention periods and data subject rights remain with you as the controller.
Do I get a data processing agreement?+
Yes, included on every plan. Request it and you get it ready to sign. It covers subject matter, duration, nature and purpose of the processing, the categories of data subjects and the technical and organisational measures, including who can access your instance administratively.
Is LoRaWAN sensor data even personal data?+
More often than people assume. A single temperature reading is not. But as soon as a sensor can be mapped to a meter, a dwelling, a vehicle or a workstation, personal data is involved. Consumption curves from submetering reveal presence; position data from asset tracking produces movement profiles. The mapping table between device and object is almost always the critical part, not the reading itself.
What happens to my data if I cancel?+
You receive a complete export. ChirpStack is MIT licensed, so the instance can be kept running by you or migrated to another provider. There is no minimum term and Setup according to agreed scope making a move artificially expensive.
Can I choose a region outside the EU?+
Yes, six of the Germany; other locations on request are outside the EU. You would then be exporting personal data to a third country and need your own legal basis under Chapter V GDPR, usually standard contractual clauses plus a transfer risk assessment. If latency to your gateways is decisive, that can be the right decision. It should simply be a deliberate and documented one.
Questions your compliance review left open?
Provisioning, any pilot and contract terms are agreed in the proposal. There is no automatic trial subscription.
WZ-IT assesses your configuration and agrees provisioning and operations with you.
Non-binding monthly indication for a standard environment in Germany. Setup, migration, additional integrations and vendor licences are quoted separately according to scope. Term and notice period are defined in the proposal.