Ask a care software provider where your data actually lives. You will often get a vague answer. "The cloud." "Secure servers." Rarely a country, a company, or a set of rules you could check.

It is a fair question to push on, because the answer decides who can reach your residents' records and what happens to them if the provider is sold or shuts down. Below are three questions worth asking any provider, and our own answers to them, named rather than gestured at.

Why the answer matters

Care records are sensitive by definition. Medical information, incident reports, family contact details, and under GDPR most of it counts as special category data, which carries stricter rules than an email list.

Where that data physically sits decides which country's laws apply to it. That matters on an ordinary day, when someone asks what you hold about them. It matters more on a bad one: a breach, a dispute, or a provider that goes quiet and takes your records with it.

Three questions worth asking

  • Where is it hosted, and by whom? Not "the cloud". A country and a company name. A provider that cannot tell you is telling you something.
  • What rules protect it, and is that written down? GDPR sets real obligations on consent, access and breach reporting. Ask whether you get a data processing agreement, since that is the document that binds the provider rather than just reassuring you.
  • Can you get it back out, and in what format? Ask which records export, in what file format, and whether you need to raise a support ticket to do it. "Your data is always available" is not an answer.

Our answers

Granily runs on servers from Hetzner Online GmbH, in Germany, so your data sits in the EU under GDPR. This marketing site is served through Cloudflare. Both are named as sub-processors in our privacy policy, along with what each one handles, and we sign a data processing agreement with every home.

On getting data out, here is exactly where we stand. Incidents, tasks, the audit log and training compliance export as CSV from the web app, whenever you want, without asking us. Care plans print. Care notes cannot be exported as a CSV yet, which is the gap in that list, and we would rather write it here than let you find it in month three.

If a provider will not answer

None of this is complicated once the questions are specific. Where is it hosted. What rules protect it. Can I get it back out, and how.

Most providers can answer all three clearly, and a good one will not mind being asked. If a provider cannot, or will not, that is worth weighing before you sign, because the same vagueness tends to show up later when you actually need something. The rest of how we build works the same way: say the specific thing, including the parts that are not finished.