Where Manufacturo hosts and processes EU customer data
Manufacturo hosts European customers' data on Microsoft Azure data centers in the EU, and Microsoft staff access to EU data can be restricted to EU residents only.
As an MES provider, we store operational and production data such as work instructions, bills of materials, and traceability records—which for aerospace, space, and defense teams is as sensitive as anything in the business.
The table below summarizes how Manufacturo manages access to EU customer data:
Public cloud with sovereign policies
Manufacturo gives EU customers control over who can access their data: Microsoft's Sovereign Control Panel and Data Guardian capabilities allow our clients to restrict Microsoft staff access to EU residents only, and Customer Lockbox adds a further safeguard by requiring Microsoft support to obtain approval before accessing any resources. Manufacturo’s support and services teams are also based in the EU, so European clients receive local support.
We offer Manufacturo as an on-prem solution for full control
Manufacturo can be delivered as a package installed in the customer’s own data center, giving air-gapped control over your data, while our engineers provide all the necessary updates. Our team will help you implement Manufacturo on-site and adjust it to your manufacturing needs.
Manufacturo’s security certifications and independent audits
We conform to cybersecurity practices and standards recognized worldwide, including OWASP and the Microsoft Security Development Lifecycle (SDL).
How Manufacturo approaches EU data sovereignty
European clients contract with Manufacturo Sp. z o.o., registered in Poland, so the agreement, data processing, and obligations sit under EU law: GDPR, NIS-2, and the EU Data Act framework.
Regulations we operate in line with:
- GDPR: Privacy by design and by default, data minimization, and the right to erasure are built into how we operate. Every client receives our Data Processing Agreement (DPA), which specifies our security measures, standards and subprocessors, granting full transparency on who processes your data.
- EU Data Act: We are extending self-service data export and provider switching, so you can retrieve your business data and move it to another provider whenever you choose, keeping you free of vendor lock-in.
- NIS-2: We align with the EU's cybersecurity directive, including supply-chain security and vendor risk management, verifying and monitoring the security posture of the third-party providers we rely on.
Independent audits that we conform to:
- SOC 2 Type II: We undergo annual, independent attestation, confirming our security controls operate effectively over time, across security, availability, processing integrity and confidentiality.
About Manufacturo’s Data Processing Agreement (DPA)
Manufacturo gives every new client a Data Processing Agreement under Article 28 GDPR. In this relationship, the client is the data controller and Manufacturo the data processor.
The DPA specifies the security measures and standards Manufacturo applies, and names its subprocessors, so the client has full transparency over who processes their data.
How Manufacturo manages its subprocessors
A subprocessor is a third party that may process a client’s personal data on Manufacturo’s behalf. Manufacturo discloses its subprocessors in the DPA, so clients can review the processing chain and object to any that does not meet their requirements.
Under its NIS-2 aligned supply chain practices, Manufacturo verifies and monitors the third parties in its processing chain.
Does Manufacturo transfer EU customer data outside the EU?
European clients sign their contract with the Polish entity, and their data is stored in the EU. By default, Manufacturo does not transfer that data outside the EU. Where any processing involves a subprocessor outside the EU, it is covered by an approved privacy framework or Standard Contractual Clauses.
Learn more about data sovereignty in this blog article by our CEO, Tadeusz Dyduch.
What Manufacturo's EU data sovereignty practices mean for your compliance and security teams
Manufacturo's EU data sovereignty practices let manufacturers verify their supplier, keep their own data-protection standards, and keep control of their production data. This applies to operational data in the MES (for example production records) as well as to personal data.
You enter a partnership with a GDPR compliant supplier
We disclose our subprocessors openly, so you can verify your supply chain is GDPR compliant and object to any that don't meet your requirements.
You’re maintaining your security standards
If you operate in defense or another data-sensitive industry, our data sovereignty policies let you uphold your own data-protection standards.
You remain in control of your data
You retain the freedom to manage and transfer the data we store for you, whenever you need to, with no vendor lock-in.
Frequently asked questions
Yes. European client data is processed under GDPR. Every client signs a DPA and privacy by design, data minimization, and the right to erasure are built into Manufacturo's operations.
Manufacturo hosts European customer data on Microsoft Azure in the Netherlands and Germany. Microsoft staff access can be restricted to EU residents, and Customer Lockbox requires approval before Microsoft support accesses any resource.
Subprocessors are disclosed in the DPA, with each relationship covered by an approved privacy framework or Standard Contractual Clauses.
The client is the data controller; Manufacturo is the data processor, as set out in the DPA under Article 28 GDPR.
European customer data is stored in the EU. Any transfer to a Manufacturo group entity or subprocessor outside the EU is covered by Standard Contractual Clauses or an approved privacy framework.