privacy policy

evrtng functions, Dorfstrasse 1, CH-8934 Knonau, Switzerland
Last updated: July 2026

1. Overview

This Privacy Policy describes how evrtng functions (“Provider”, “we”) processes personal data when you use our serverless computing platform at https://functions.evrtng.cloud (“Service”). The Provider is subject to the Revised Swiss Federal Act on Data Protection (revDSG).

2. Data We Process

2.1 Account & Authentication Data

When you register or log in, authentication is handled by Authentik (OIDC single sign-on). The following data is processed:

– Email address
– Display name
– Group membership (for plan assignment: free, starter, pro, enterprise)
– OpenID Connect token (session-only, not stored)

Authentication data is stored in Authentik’s database. WordPress receives your email address and display name via OIDC. No password is stored by WordPress for SSO users.

2.2 Platform Usage Data

When you execute functions on the platform, the following usage data is collected by Apache OpenWhisk:

– Function name and namespace
– Number of invocations
– Execution duration (milliseconds)
– Memory allocated (MB)
– Invocation result (success/error)
– Timestamp
– HTTP request metadata (method, path, status code)

This data is stored in CouchDB and Kafka for billing, quota enforcement, and monitoring purposes. Usage data is retained for 90 days in Kafka and in CouchDB for the duration of the account lifetime plus 10 years (Swiss CO retention period for billing data) (aggregated billing records). After the retention period expires, the data is deleted.

2.3 Payment Data

Payment processing is handled by Stripe Payments Europe, Ltd. When you subscribe to a paid plan, the following data is processed:

– Email address (passed to Stripe for checkout)
– Subscription plan and price
– Payment method (handled entirely by Stripe, never stored by us)
– Stripe customer ID and subscription ID (stored in our database for account linkage)

We do not store, process, or transmit credit card numbers or other sensitive payment data. All payment data is handled exclusively by Stripe, which is PCI DSS Level 1 certified.

2.4 Log Data

The API gateway (APISIX) logs HTTP request metadata for billing and security purposes:

– Timestamp
– HTTP method and path
– Response status code
– Client IP address (via X-Forwarded-For header, used for rate limiting)
– Request/response size

Log data is sent to our internal logpkg action for processing and stored in CouchDB. Logs are retained for 90 days.

2.5 Monitoring Data

Prometheus and Grafana collect and visualize platform metrics for operational purposes:

– Infrastructure metrics (CPU, memory, disk usage, network)
– OpenWhisk component metrics (controller, invoker, Kafka)
– API gateway metrics (request rate, latency, error rate)
– Billing consumer metrics

Monitoring data is aggregated and does not contain personal data beyond IP addresses (used for rate limiting visualization). Metrics are retained for 15 days (Prometheus).

2.6 Cookies

The website uses the following cookies:

– pll_language: Stores your language preference (EN/DE). Duration: 1 year.
– WordPress session cookies: Required for logged-in users. Duration: 2 days (or 2 weeks if “remember me”).
– WPConsent: Stores your cookie consent preferences. Duration: 30 days.

No tracking or advertising cookies are used.

3. Legal Basis

– Contract performance (Art. 31 revDSG): Processing of account, usage, and payment data for providing the Service.
– Legal obligation (Art. 31 revDSG): Retention of billing records as required by Swiss commercial law.
– Legitimate interest (Art. 31 revDSG): Log and monitoring data for security and operational stability.
– Consent (Art. 32 revDSG): Cookie consent via WPConsent banner.

4. Data Sharing

We share personal data with the following third parties:

– Stripe Payments Europe, Ltd.: Payment processing. Stripe processes your email address and payment data under its own privacy policy (https://stripe.com/privacy).
– Authentik: Authentication provider. Authentik stores your email, name, and group memberships. Authentik is self-hosted on our infrastructure.
– Gardener / OpenStack: Infrastructure provider. Hosts the Kubernetes cluster. Processes IP addresses and infrastructure metrics.
– Apache OpenWhisk: Processes function code and execution data. OpenWhisk is self-hosted on our infrastructure.

No data is shared with advertising networks or analytics providers.

5. Data Retention

– Account data: Retained for the duration of the account. Deleted on request.
– Usage/billing data: Retained for 10 years (Swiss commercial law requirement).
– Log data: 90 days.
– Monitoring metrics: 15 days.
– Cookie consent: 30 days.

6. Your Rights

Under revDSG, you have the right to:

– Access your personal data (Art. 25 revDSG)
– Rectify inaccurate data (Art. 32 revDSG)
– Erase your data (Art. 32 revDSG)
– Restrict processing (Art. 32 revDSG)
– Data portability (Art. 28 revDSG)
– Object to processing (Art. 32 revDSG)
– Withdraw consent at any time (Art. 32 revDSG)

To exercise these rights, contact us at mail@evrtng.cloud.

7. Data Security

We implement appropriate technical and organizational measures to protect your data:

– TLS encryption for all HTTP traffic (Let’s Encrypt certificates)
– Network policies isolating function execution pods
– Rate limiting at the API gateway (APISIX)
– Encrypted secrets in Kubernetes
– Regular backups (K8up, daily, S3-encrypted)
– Access control via OIDC authentication (no shared passwords)
– Persistent volumes on cloud-provider infrastructure (Gardener, data center Zurich) with physical access control. At-rest encryption at the volume level is not implemented; access protection is enforced via Kubernetes RBAC, network policies, and data center security.

8. Data Processing Outside Switzerland/EU

Data is processed exclusively in Switzerland (Zurich) and the EU (Stripe, Ireland). No data is transferred to third countries outside Switzerland/EU without adequate protection guarantees.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available at https://functions.evrtng.cloud/privacy-policy/.

10. Contact

For questions regarding data protection, contact us at:

evrtng functions
Dorfstrasse 1
CH-8934 Knonau
Switzerland
Email: mail@evrtng.cloud

Data Breach

evrtng functions, Dorfstrasse 1, CH-8934 Knonau (“Provider”, “we”) takes the security of personal data seriously. This section describes the process the Provider follows in the event of a data breach involving personal data processed via the serverless computing platform, in accordance with the revised Swiss Data Protection Act (revDSG), in particular Art. 24 revDSG.

Definition

A “data breach” (“Datenpanne”) is a security incident leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed by the Provider. This includes but is not limited to: unauthorised access to customer namespaces, exfiltration of function payloads containing personal data, compromise of API keys or Authentik credentials, and loss of availability of personal data held on the platform.

Internal Process

Upon identification of a suspected or confirmed data breach, the Provider initiates the following process:

1. Detection

The breach is detected through automated monitoring, customer reports, employee observation, or third-party notification. Any individual who becomes aware of a suspected breach must immediately notify the internal security team at security@evrtng.cloud.

2. Assessment

The security team assesses the breach within 24 hours of detection to determine: the scope of affected personal data, the categories of data subjects concerned, the likely consequences of the breach, and the technical and organisational measures available to address it. The assessment determines whether the incident qualifies as a notifiable data breach under Art. 24 revDSG.

3. Containment

The Provider takes immediate steps to contain the breach and limit its impact. This may include: isolating affected namespaces, revoking compromised API keys or Authentik sessions, patching the underlying vulnerability, restoring data from backups, and restricting platform access where necessary.

4. Notification to EDÖB (Art. 24 revDSG)

If the breach is likely to result in a high risk to the rights and freedoms of natural persons, the Provider notifies the Federal Data Protection and Information Commissioner (Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter, EDÖB) without undue delay (“so bald wie möglich”), in accordance with Art. 24 revDSG. The notification to the EDÖB includes at least:

The nature of the breach and, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
The likely consequences of the breach;
The measures taken or proposed to address the breach and mitigate its possible adverse effects.

Where it is not possible to provide all information at once, the information may be provided in phases without further undue delay.

5. Notification to Affected Customers

The Provider notifies affected customers without undue delay after becoming aware of a data breach affecting their personal data or the personal data they process via the platform. The notification describes the nature of the breach, the measures taken, and any steps the customer should take to protect the data subjects whose data they process. The notification is sent to the account owner’s email address on file.

Where the breach affects end data subjects whose data the customer processes via the platform, the Provider supports the customer in fulfilling its own notification obligations under revDSG by providing the necessary information about the breach.

6. Documentation

The Provider documents every data breach, regardless of whether it is notifiable to the EDÖB or affected customers. The documentation includes at minimum:

The scope of the breach (categories and approximate number of data subjects and records affected);
The time of detection and, where known, the time of occurrence;
The cause of the breach;
The measures taken to contain, address, and mitigate the breach;
The notifications made (to EDÖB and/or affected customers), with timestamps.

This documentation is retained in accordance with Art. 25 revDSG and is available to the EDÖB upon request. The documentation enables the EDÖB to verify compliance with Art. 24 revDSG.

Contact

For questions about data breach handling, or to report a suspected breach, contact:

Email: security@evrtng.cloud
Response: Within 24 hours, 7 days a week

If you are a customer and believe your account or data has been compromised, contact us immediately. Do not attempt to investigate independently, as this may compromise forensic evidence.

Cooperation with Authorities

The Provider cooperates fully with the EDÖB and other competent Swiss authorities in the investigation of data breaches. The Provider provides all necessary information and documentation on request.

This section forms part of the Privacy Policy of evrtng functions, Dorfstrasse 1, CH-8934 Knonau. Swiss law (revDSG) applies.