Your files stay in the EU
Cloud runs in Frankfurt: the app on Fly.io, the database on Neon (AWS eu-central-1), files in Cloudflare R2's EU jurisdiction. US customers are served from here until the US region opens.
TRUST
Your brand,
in plain sight.
Where your files live, who handles them, and what we will never do with them.
WHAT WE PROMISE
Four things
we hold to.
No training on your assets
We never train models on your files, metadata or rules, and Artbucket runs no model of its own. Agents you connect act with your key and the permissions you chose.
No telemetry
The open-source core sends nothing anywhere: not to us, not to anyone. This site loads no trackers either.
Found a vulnerability?
Report it privately through GitHub Security Advisories, not a public issue. You get an acknowledgement within 72 hours and an assessment within seven days.
Report privately Security policySUBPROCESSORS
Who runs
Artbucket Cloud.
The companies that handle your data for Cloud. Self-hosted installs use none of them unless you choose to.
| Company | What for | Where |
|---|---|---|
| Cloudflare | Edge, DNS, file storage (R2), portals and custom domains | EU for stored files |
| Fly.io | Runs the app | Frankfurt |
| Neon | The database | Frankfurt |
| Resend | Sign-in codes and account email | |
| Stripe | Payments, for paid plans | Global |
| Grafana Labs | Uptime and logs | Frankfurt |
| GitHub | Brand as code, only when you connect a repository | US |
SOURCES
Where BrandHub's
listings come from.
The brands under Unclaimed brands on BrandHub were not made by their owners. Is your brand here? Claim it with your domain.
AgenticAdvertising.org
Entries of its AdCP brand registry whose owners proved their domain to it, or publish a brand.json on it, and for a few well-known brands, the Brandfetch data it holds for them. Each listing credits the registry, links to its entry and is read again every few days; one that leaves the registry leaves BrandHub.
The registryProve the domain, take the listing
An organization on Cloud that verifies a listing's domain is offered it: the brand becomes its own, in its workspace, and the old listing points there. Nothing is sent to the registry.
QUESTIONS FROM YOUR SECURITY TEAM?
Ask us
anything.
Or read the code: the core that runs on Cloud is public, line by line.