The information the Data Act (Regulation (EU) 2023/2854) asks a cloud service to publish: where the infrastructure is and whose law applies (Art. 28), the measures against unlawful access by non-EU governments (Arts. 28 and 32), what you can take with you and in which formats (Art. 26), how switching works, and its charges (Art. 29). The contract terms are in Terms §9.4. You export your data yourself, in the dashboard's Settings → Your data (section 3); switching to another provider follows the steps in section 4.
1. Where the infrastructure is, and whose law applies
| Service | Where it runs | Jurisdiction |
|---|---|---|
| OneActor itself (the company) | Portugal | Portugal and the EU |
| Platform, workspaces, your apps' functions, databases, cache, queues and file storage | Amazon Web Services, region eu-central-1 (Frankfurt, Germany) | EU; the provider, Amazon Web Services EMEA SARL (Luxembourg), belongs to a US group |
| Your published sites (content delivery) | Amazon CloudFront edge locations worldwide, each visitor served from one near them | EU, and the country of the edge location for the copies cached near a visitor (cached copies only) |
| iPhone builds of your phone apps | A Mac dedicated to OneActor at Scaleway, Paris (France) | EU |
| AI model processing | The AI providers on the sub-processor page, mostly in the United States | United States (and others per provider) |
| Payments (the sale of plans and credits) | Link — Sold through Link, LLC, an affiliate of Stripe, United States; an independent controller of your payment data under its own privacy policy | United States and other countries |
2. Measures against unlawful access by non-EU governments
- Technical: data at rest in the EU region; keys and variables encrypted with keys held in the EU region's key management service; TLS in transit; no copies of customer databases outside the EU region.
- Organisational: OneActor is an EU company with no US parent; requests from any authority are checked for legal validity and scope, challenged where there are grounds, and answered with the minimum data required.
- Contractual: our providers are bound by data processing terms that require them to challenge requests where possible and to notify us unless prohibited.
- Notice to you: we tell you before complying with a request from a non-EU authority concerning your non-personal data, unless the request is lawfully confidential (Data Act Art. 32).
AI model providers in the United States can be subject to US law on access to data. Content the agents send them is processed there; see the Privacy Policy for the safeguards.
3. What you can take with you
The owner of a workspace asks for an export of it in Settings → Your data, as often as needed. We email you when it is ready, and you download it from Settings, signed in, for 30 days. It is one archive (.tar.gz) with a README that says what is where and what is not in it, and a manifest with each file's size and checksum.
| Data or asset | Format |
|---|---|
| Source code and full git history of each project | A git bundle per branch, with every branch and tag |
| The project brief's documents | The files as you uploaded them |
| Tickets, the board and agent conversations | Not in the export: we send them to you on request, in a common machine-readable format |
| Your databases (test and production) | SQL (structure and rows) and CSV per table, with the PostgreSQL version |
| Files in your apps' storage | The objects, with their keys |
| Your apps' configuration: releases, deployments, variables, the domains you connected and the records they use | JSON and CSV; a variable's value only when it is not secret |
| Stored keys and other secret values | Their names only: the values are never exported or shown, so you create new keys at the new provider |
| Your phone apps: package names, bundle identifiers, upload certificates, the store steps you marked done, and every build's record | JSON and CSV. The build files themselves you download in the dashboard. The keys that sign the apps are never exported: Google Play resets an upload key at your request, and you make an iPhone distribution certificate of your own |
| Your Apple account: the App Store Connect key's IDs, the team, and the certificates, identifiers and profiles OneActor made there | JSON; never the key itself, which you hold already |
| Your account, the organization, its members, invitations and audit log | JSON and CSV |
| Usage and billing records, with purchases, withdrawals, refunds and disputes | CSV and JSON |
One export carries up to 5 GiB of your apps' stored files and lists any others by key. Files in a workspace that were never committed to the project's repository are not in it. Usage records older than 90 days are kept in our billing archive, and we send them on request.
Not exportable (specific to how OneActor works internally, or would reveal trade secrets): the agents' own instructions and configuration, which a project's export leaves out; our internal logs and metrics; and the platform's own code.
This table is the register of formats of Art. 26, and is kept up to date; each export's README names the standards and versions used (for example the PostgreSQL major version).
4. How switching works
- You tell us by email that you are switching. You may give up to 2 months' notice, or less.
- Transition — at most 30 days after the notice period. The Service keeps running, you export everything in section 3 from Settings as often as you need, we help you move it, and tell you of any known risk to continuity.
- Retrieval — at least 30 days after the transition, during which your data stays available to download.
- Erasure. When retrieval ends or you confirm the switch is complete, we delete your exportable data and confirm it in writing, except what the law requires us to keep (for example invoices).
If 30 days is not technically feasible for your case, we tell you within 14 working days, explain why, and propose a period of no more than 7 months.
5. Charges
Switching and export are free. We charge no switching or data-egress fee, now or after 12 January 2027, when the law bans them.