Security and Data Residency

Your AI agent runs on a dedicated, single-tenant server in the EU. Here is exactly how we host, protect, and isolate your data, and what we can and cannot see.

Where your data is hosted

Your OpenClaw instance runs on a dedicated VPS hosted in the European Union, in Denmark, powered by our infrastructure partner Webdock, on AMD EPYC Gen3 hardware.

Your application database and the OneClickClaw platform itself are hosted within the EU (Neon for the database, Replit for the application layer). Data residency is EU-default, not an add-on.

Single-tenant isolation

Every customer gets their own dedicated server. This is not shared hosting and not a shared container.

• Nobody else can see your conversations, your API keys, or your bot configuration.
• Your workload does not share memory, disk, or process space with another customer.
• There is no cross-tenant data path to isolate, because there is no shared tenancy in the first place.

Encryption

• In transit: all traffic is encrypted with TLS 1.2 or higher.
• At rest: your Bring Your Own Key (BYOK) API keys are encrypted using AES / Fernet symmetric encryption before they are transmitted to your server, and they are stored only on your dedicated VPS, never in a central store.

How your BYOK keys are stored

You bring your own key from Anthropic, OpenAI, or any provider OpenClaw supports.

• Your key is encrypted at rest with AES / Fernet before it ever leaves our platform.
• It is stored only on your dedicated VPS and used only by OpenClaw at runtime.
• We never store your AI provider key centrally and we never access it in plaintext.
• Your chosen AI provider is your own sub-processor. We are not in the loop on those API calls.

Backups and retention

• Automated daily or weekly backups are included on all plans.
• Backups are retained within the same EU region as your server.
• Server activity and monitoring metadata are automatically deleted after up to 90 days.

Access controls

• Customer SSH access is optional and opt-in, and free when you enable it. It is off by default.
• Access to monitoring data and infrastructure is restricted to authorised OneClickClaw personnel.
• We do not access the contents of your business data, customer conversations, AI provider responses, or files on your server, unless we are actively investigating a monitoring alert or responding to a valid legal request.

What we monitor, and what we do not

We monitor server metadata for security and abuse detection. We do not read your content.

We monitor:

• SSH session metadata: login times, source IP addresses, session durations, and commands executed.
• Network connections: destination IPs, ports, and byte counts, with no packet contents.
• Filesystem metadata: file names, sizes, and last-modified timestamps, with no file contents.
• Listening ports: the port number and the name of the process listening on it.

We do not access:

• The contents of your business data, your customer conversations, your AI provider responses, or any files on your server, unless investigating an alert from monitoring or responding to a valid legal request.
• Your API keys. They stay encrypted on your VPS and are used only by OpenClaw at runtime.

Full detail is in our monitoring documentation.

Sub-processors

We use a small, named set of sub-processors. This list is identical to the one in our Privacy Policy and our Data Processing Agreement.

Your chosen AI provider under BYOK is your own sub-processor and is not on this list. Anthropic appears only because we use it to power our own support chatbot, not to process your workloads.

Vulnerability management and patching

• Your OpenClaw instance receives automatic updates to stable versions.
• SSL and firewall configuration are managed for you.
• DDoS protection, rate limiting, and input sanitisation are applied at the platform level.
• To report a vulnerability, contact info@oneclickclaw.io.

Incident response and breach notification

If a personal data breach affects your data, we notify you without undue delay after becoming aware of it, with the nature of the breach, the data affected, the likely impact, and the steps we are taking.

Where we act as data controller, we notify the competent supervisory authority within 72 hours of becoming aware of a breach, and affected individuals without undue delay where the breach is likely to result in a high risk. Our competent authority is the Hellenic Data Protection Authority (HDPA).

Your data: export and deletion

• Export: to export your data or take a backup of your instance, contact info@oneclickclaw.io.
• Deletion: when your server is destroyed, your encrypted BYOK keys are deleted with it. Account data is deleted within 30 days of account closure. Monitoring metadata auto-deletes after up to 90 days.
• Your GDPR rights: access, rectification, erasure, restriction, portability, and objection. Contact info@oneclickclaw.io.

GDPR documents

• Data Processing Agreement (DPA)
• Privacy Policy
• Monitoring documentation
• Terms of Service