Security and GDPR
Your data.
In the EU. Encrypted.
Calco is built for trade businesses. You own your data, we host in the EU, everything is encrypted, and you can export it all anytime.
Data residency in the EU
- All your data is stored with Supabase in Frankfurt, Germany (eu-central-1) - no storage outside the EU. Quote generation is processed by Anthropic (Claude) as a sub-processor under a data processing agreement. We fall under GDPR + EU data protection law.
Encrypted across the stack
- TLS 1.3 in transit. AES-256 (pgcrypto) on your integration API keys at rest, with a dedicated key that never lives in the database. Passwords are bcrypt-hashed and can never be read by Calco staff.
Row-level security per tenant
- Every table has RLS policies so one tenant can never see another's data. Even with an SQL injection, a user would only see their own company's rows.
Audit log of every action
- Every event is logged: who sent which quote, when it was accepted, which IP clicked 'Accept'. Visible under Activity at calcoapp.com/admin/aktivitet and included in the data export.
GDPR Art. 15 + 17
- Request a data export or permanent account deletion under Settings -> Data and personal information (calcoapp.com/admin/indstillinger?fane=data). Export is delivered as a ZIP with all company data (JSON). Deletion is carried out within 30 days.
Authorised work separated
- When Calco generates quotes involving work that requires authorisation (gas, fixed electrical installation, wet rooms), a separate line item is added so responsibility is clearly placed with the tradesperson.
Backup every day
- Supabase takes automatic point-in-time backups every day with 7-day retention. We test restore procedures quarterly.
You own your data
- You can always export everything (company, quotes, customers, settings, audit log) as JSON. We don't build lock-in through proprietary formats.
Frequently asked questions
Compliance,
without surprises in the fine print.
- Where is my data stored?
- With Supabase in Frankfurt (EU). We don't use US-hosted services for storage. Edge functions run in Supabase's edge network but no customer data is persisted outside the EU.
- Can Calco staff read my quotes or customer data?
- Technically, Supabase administrator staff have access to the underlying database (they are your sub-processor). Calco employees work on the code, not production data. You can request a signed DPA (data processing agreement).
- What happens if I cancel?
- You can export all your data under Settings -> Data and personal information (calcoapp.com/admin/indstillinger?fane=data) as a ZIP before you cancel. After cancellation we delete all your data within 30 days. We send a confirmation of deletion.
- How does Calco handle my customer data?
- When you generate a quote, Calco sends the job description and any photos to our sub-processor Anthropic (Claude) to build the quote. Anthropic does not retain data after 30 days and does not use it for training. Your customer data (name, address, email) is sent only for context - it is not stored by Anthropic.
- Is Calco GDPR-compliant?
- We support the core GDPR rights: Art. 15 (data export via dashboard), Art. 17 (deletion via dashboard), Art. 30 (we keep records of processing). Our DPA (data processing agreement) is available at /legal/dpa.
- What happens if you get hacked?
- We have an incident-response plan ready. If a breach affecting personal data is discovered, we inform you + the Danish Data Protection Agency within 72 hours per GDPR Art. 33. Service breaches not involving personal data are communicated as quickly as possible via a status banner in the app + email.