Sanbox By Sanlabs

Home

EU Data Act information

Sanlabs GmbH last updated

Sanbox is a data processing service under Regulation (EU) 2023/2854, the EU Data Act. This page gives the information the Act asks providers to publish: where our infrastructure is, how we protect your data against unlawful access by authorities outside the EU, how to switch to another provider or export your data, the formats your data comes in, and our fees. Your subscription agreement refers to this page.

Where our infrastructure is

Sanbox is provided by Sanlabs GmbH, Pflugstraße 14, 10115 Berlin, Germany, a company under German law. Our full details are in the Impressum.

  • Computers, their disks and snapshots, uploaded files and our model gateways run on servers of Hetzner Online GmbH in data centres in Germany and in Helsinki, Finland.
  • Accounts, run records and settings are stored in a database that Supabase operates on Amazon Web Services in Frankfurt, Germany.
  • Account emails, such as sign-up and password-reset emails, are sent through Resend from its EU region in Ireland.

All infrastructure that stores your data is located in the EU and is subject to EU and member state law. Supabase (Singapore) and Resend (USA) are companies based outside the EU, so the laws of their home countries may also apply to them. Our agreements with them include the EU Standard Contractual Clauses.

Data that your Computers send to services you connect yourself, such as your model providers, leaves Sanbox under your own agreements with those providers.

Protection against access by authorities outside the EU

We take technical, organisational and contractual measures to prevent authorities outside the EU from accessing or transferring your data where that would conflict with EU or member state law.

  • Technical. Your data is stored in the EU and is encrypted in transit and at rest. Sanlabs controls the encryption keys for its servers; Supabase encrypts the database at rest.
  • Organisational. We check every request from an authority outside the EU. We respond only where an international agreement, such as a mutual legal assistance treaty, or the conditions in Article 32 of the Data Act require it. We then disclose the minimum amount of data the request permits, and tell you before we comply, unless a law-enforcement request must stay confidential.
  • Contractual. Our data processing agreement with you commits us to notify you of requests from authorities and to disclose only what the law requires. Our sub-processors are bound by data processing agreements.

Switching to another provider or exporting your data

  1. Tell us in text form, for example by email to support@sanlabs.ai, with one month's notice, whether you want to switch to another provider, move your data to your own infrastructure, or have it erased.
  2. During a transitional period of up to 30 days, your subscription continues. We help with the switch, keep the service running at the agreed security level, and tell you about any known risks to continuity. You can extend the period once. If 30 days is not technically feasible, we tell you within 14 working days and set a longer period of up to 7 months.
  3. After your subscription ends, you can retrieve your data free of charge for 30 days. We then erase it, including backup copies, as set out in your data processing agreement.

You can export your data at any time through the console, the API and the Sanbox CLI. Some limits apply:

  • Sanlabs' own software, base images and internal security logs are not exportable.
  • Stored credentials, such as model provider keys, are not exported in readable form. Re-enter or rotate them with your new provider.
  • A Computer's running state, including memory snapshots, is specific to Sanbox and cannot be moved to another provider. To switch, export a Computer's files and recreate it at the destination.

Export formats

Exported data uses open, documented formats:

  • Files on a Computer's disk, including outputs and installed software: copied with sanbox cp, which transfers files and folders as POSIX tar archives (pax format, IEEE Std 1003.1). On request, we provide a complete archive of a Computer's files.
  • Run outputs: downloaded with sanbox runs download in their original file formats.
  • Uploaded input files: provided on request as the ZIP archives they were uploaded in.
  • Templates and configuration: sanbox templates get <id> --json, as JSON (RFC 8259, UTF-8).
  • Run records and event history: sanbox runs get <id> --json and sanbox runs events <id> --json, as JSON.

The API returns the same data as JSON over HTTPS. Each CLI command documents its options with --help.

Fees

Our standard fees are set out in your order form and on our pricing. We charge no early termination fees, and no fees for switching or for retrieving or exporting your data.

Contact

For switching or export requests, write to support@sanlabs.ai.