A company in Cyprus, data in Germany

Lethra Technologies Ltd. is registered in Limassol, Cyprus. The infrastructure runs in German data centres. Those are two different decisions, made for two different reasons, and conflating them is a common enough mistake that it is worth separating them properly.

A compliance reviewer will ask about both. Publishing the reasoning is cheaper than explaining it individually, and it is the kind of question where a vague answer costs more than the question was worth.

The two questions are not the same question

Where a company is incorporated determines its corporate law, its tax treatment, its contracting entity, and which courts hear a dispute about the contract.

Where data physically resides determines which legal orders can reach the machines it sits on, which supervisory framework applies to the processing, and what a transfer assessment has to consider.

These get discussed as one topic — usually under a heading like sovereignty — and they come apart immediately under any real scrutiny. A company incorporated in the EU can and frequently does run on infrastructure subject to non-EU jurisdiction. The reverse also happens. The entity's flag tells you very little about where the bytes are exposed.

For an evidence product this distinction is not academic. The property we are selling is that a partner's documents are not readable by us and not reachable through us. That property is established by the storage arrangement and by the encryption model, not by which registry holds our incorporation documents.

Why the data is in Germany

This is the decision that affects partners, so it comes first.

Our target market is DACH platforms holding documents for German, Austrian and Swiss users. Their compliance teams have an established position on where such material sits, and it is not a position we wanted to argue with.

The infrastructure runs in Falkenstein and Nuremberg, with synchronous replication between them, and a Helsinki region held for disaster recovery. All EU. The primary and secondary are in the same country as the majority of the documents.

The specific thing being avoided is a storage path subject to non-EU jurisdiction. Where a provider is subject to legal orders that can compel production of data regardless of where it is physically held, a transfer assessment becomes a substantial piece of work with an uncertain conclusion, and it becomes a conversation between our partner and their own compliance function that we cannot participate in usefully.

We would rather not have that conversation at all than have it well. Using European infrastructure operated by a European company removes it from the evaluation instead of adding a section to it.

Worth being precise about the limits of the claim. Geography is one control among several, and on its own it is a weaker one than it is often presented as. The stronger property is that the plaintext never reaches us: partners encrypt on their side with a key that never transits our systems, so a compelled production against us yields ciphertext regardless of which jurisdiction compelled it. Data residency is the belt. The encryption model is the braces, and it is the one doing the real work.

Why the company is in Cyprus

The honest answer is more ordinary than the infrastructure one, and it is the answer we would rather give than a constructed narrative.

Cyprus is an EU member state with English-language company administration, a functioning registry, and a professional services layer that handles international incorporation as routine work. For a company whose operations are distributed and whose market is elsewhere in the EU, it is a practical place to be a legal entity. There is a real technology sector in Limassol, which matters for hiring and for not being an isolated outpost.

What it does not do is affect the product. Our partners contract with a Cypriot entity; their documents sit in Germany; the entity's jurisdiction does not create a path to the data, because there is no path to the data that runs through the entity rather than through the infrastructure.

A partner's transfer analysis should reach the same conclusion, and if it does not we would like to know, because that would be a defect in either our explanation or our architecture.

The question this actually invites

Naming a registered address in a small jurisdiction invites a specific suspicion, and it is better addressed than left implied: is this a letterbox.

The answer is that the registered address is real, it is published in full on our own site, and it is where the entity is administered. Engineering is not conducted from a mailbox. And the honest asymmetry is that a company at our stage is small — the entity is young, and anyone conducting diligence will find a young entity.

What we would rather be judged on is the architecture, which is published, and the operational commitments, which are checkable. A company can be new. A design either survives scrutiny or does not, and that is the thing we would rather have examined.

What this means for a partner's assessment

Three things are worth extracting for anyone doing this evaluation on us.

Ask about the storage path, not the letterhead. Which physical regions, operated by which company, subject to which jurisdiction, with what replication. The entity's registration is a much weaker signal than it appears and a vendor who leads with it is answering an easier question than the one asked.

Ask what is cryptographically available to the provider. Data residency limits who can compel production. Encryption determines what production would yield. The second question is shorter and more decisive, and it is the one whose answer does not change when a provider restructures.

Ask what happens when the provider is gone. Jurisdiction and residency both assume the provider continues to exist. An evidence design has to work when it does not, which is a separate property from either, and the one most often left unexamined.

We have written about the third of those at more length, because it shaped more of the build than the other two combined.