WORM-enforced retention for §50 BRAO, §257 HGB, and §147 AO. Hosted in France on Scaleway — no US CLOUD Act exposure. Postgres, storage, auth, and edge functions with an audit-defensible retention story out of the box.
If you build software for lawyers, tax advisors, or Buchhaltungspflichtige (bookkeeping-obligated) SMBs in Germany, your customers are on the hook for statutory data retention that a generic backend can't defend. When a Kanzlei is audited, "we back everything up nightly" isn't the right answer — the auditor wants to see that the specific record class the statute mentions cannot be deleted within the retention window, not that it hasn't been.
Building that on top of Firebase, Supabase, or a raw AWS S3 bucket means writing your own Object Lock configuration, your own retention-hold API, your own DSAR-erasure-that-respects-legal-holds workflow, and — most importantly — your own audit-log retention that survives the same statutory window as the data it describes. That's months of work, most of which will be reviewed by a lawyer who bills in 6-minute increments.
Eurobase Legal Team is a pre-built version of that stack. WORM by default on the record classes that need it, ad-hoc holds for the ones that don't, and an honest DSAR-erasure API that returns "retained under §257 HGB, purgeable after 2036-03-14" instead of a silent no-op that will hold up in a Landesdatenschutzbeauftragte's inbox for three months.
Every object under a configured prefix (e.g. /invoices/*) is retention-locked under S3 Object Lock. Even a compromised admin key cannot delete before the retention date. Governance-mode vs compliance-mode is a per-prefix choice.
When a customer cites a legal basis mid-lifetime ("this row is subject to litigation hold"), the console's Retention tab pins the specific row, object, or table beyond its default policy. Every hold is audited with actor + basis + expected release date.
When a user asks to be forgotten, held items are refused with a specific message the requester sees in their export: "retained under §257 HGB, purgeable after 2036-03-14." No silent no-op; no ambiguous "we removed everything we could."
The audit trail survives the same statutory window as the data it describes. On standard tiers audit-log retention is 90 days; on Legal Team it matches §257 HGB / §147 AO. Hash-chained checkpoints for tamper-evidence.
Client files (Handakten) retained 6 years from case end. Configurable per-project retention policy on the /client-files/* prefix.
Split by record class: books, inventories, opening balance sheets, annual accounts, and invoices (Buchungsbelege) retained 10 years; received / sent commercial letters (Handelsbriefe) retained 6 years. Both prefixes ship with the correct default policy.
Mirrors §257 HGB: 10 years for books and accounting records, 6 years for other tax-relevant business correspondence. Tax-audit-ready retention on the /tax/* prefix.
Statutory summaries are for orientation, not legal advice — your firm's counsel is the source of truth for the specific record classes and periods that apply to your workload. Eurobase provides the WORM enforcement mechanism; the retention decision itself is yours.
Every byte of Eurobase data lives in Scaleway data centres in Paris, France (fr-par). No US-hosted services in the stack — no AWS, no GCP, no Cloudflare, no Vercel, no Stripe. That means no CLOUD Act reach, no Schrems II ambiguity, no "your data is technically encrypted at rest but the encryption keys sit in a US KMS" workaround.
Payment processing runs on Mollie (Dutch, EU-headquartered). SMS OTP runs on GatewayAPI (Danish). Every third-party processor is listed on the auto-generated Article 30 DPA report you can download per project. If a customer's Datenschutzbeauftragte(r) asks for it, you send them a PDF instead of a 40-email thread.
WORM (Write Once, Read Many) means once an object is stored, it cannot be modified or deleted until its retention period expires — even by an admin, even by a compromised key, even by a database-level DELETE. For a firm subject to §257 HGB (10y invoice retention) or §50 BRAO (6y lawyer-file retention), that guarantee is what a German auditor will ask for. Soft delete plus audit log is a nice-to-have; WORM at the storage layer is what the regulator wants to see.
Backups are recoverable — good for accident recovery, not good enough for statutory retention. A backup can be deleted, modified, or restored to a state where the data is gone. WORM Object Lock refuses the DELETE at the storage boundary. It is the difference between "we can probably restore this" and "the storage service is contractually incapable of losing this within the retention window."
The erasure API refuses each held item with a specific message the requester sees in their export: "retained under §257 HGB, purgeable after 2036-03-14." The exporter enumerates every held item plus its basis plus the earliest purge date so the user can plan a follow-up request. Honest interpretation of Article 17(3)(b) GDPR (legal obligation to retain), rather than a silent no-op that will hold up in a Landesdatenschutzbeauftragte's inbox for three months.
Legal Team is currently in closed beta. Email contact@eurobase.app with a one-line description of your workload and your retention basis (BRAO / HGB / AO / other). Grants are manual during the beta window; pricing is set per-workload until we exit beta.
Yes — Scaleway data centres in Paris, France. No US infrastructure at any point in the stack. Full sub-processor list published on the Article 30 DPA report the console auto-generates per project. If a component of the stack ever changes region, we file a versioned DPA update and notify affected projects.
One-line description of your workload plus your retention basis in an email, and we'll get back to you the same day about beta access and rough pricing.
Prefer to see the technical details first? Read the Legal Team docs or the full pricing comparison.