MusterHub
Let’s talk

Data Processing

Last updated: 29 October 2026

This page explains how data flows through MusterHub, what your service is responsible for, and where we fit in. The answers depend on which deployment option you use, so we have covered both below.

Two deployment options

MusterHub is available as a self-managed deployment, where you run your own server on your own Azure subscription, or as a managed hosting deployment, where we run a dedicated server for your service on our Azure account. The data protection picture is different for each.

Self-managed

If you provision and operate your own Azure instance, MusterHub's role is simple: we supply the software and you run it. Your data lives in your own Azure environment and never passes through ours.

  • Operational data stays on your infrastructure, apart from the two exceptions below
  • You are the data controller and the data processor for your staff's data
  • MusterHub is your software supplier, not a data processor for the data held on your server
  • A formal Article 28 DPA covering the data on your server is not required, because we never process it

There are two exceptions. The first is the initial routing lookup when a team member first sets up the app. At that point, their email address passes through our central service so the app can find your server. That email address is not retained after the redirect. The second is push notifications, which are sent through MusterHub's Firebase project (see Push notifications). If you want a short written agreement covering these narrow activities, we can provide one.

Managed hosting

If we host your server for you, we run a dedicated virtual machine in our Azure account on your behalf. That VM is isolated from all other services. No other MusterHub customer's data sits on the same database or storage volume, and there are no application-level links between services.

Your instance is hosted on Microsoft Azure (UK) infrastructure. Physical and environmental security is governed by Microsoft's ISO 27001 certified data centres, and your data remains in the United Kingdom.

In this arrangement, you are the data controller and MusterHub is your data processor for operational data. Article 28 of UK GDPR applies, which means we need a written Data Processing Agreement in place before processing begins. Contact us and we will arrange one.

In practice, that means:

  • We process your data only to run the MusterHub platform for your service
  • We do not use your data for any other purpose
  • We will notify you without undue delay if we become aware of a personal data breach affecting your data
  • We will assist you in responding to data subject rights requests where we can
  • We will delete or return your data when you leave (see below)

As the Azure administrator for your hosted instance, we have the technical means to access the data on your server. We do not access it except when needed to maintain or support the service for you. If you want a record of any support access we carry out, we can provide that.

What MusterHub's central service does

For app setup, our central service performs a routing lookup: when a team member first opens the app, they enter their email address and service code. The central service uses those details to find the address of your server and directs the app to it. After that initial connection, all communication goes directly between the app and your server. We have no ongoing access through the central service.

The email address used for the lookup is not retained after the redirect is complete.

The marketing website also handles enquiries and saved capability worksheets. These are separate from operational app routing; see our privacy policy for collection and access details.

What your service is responsible for

Self-managed

Because you operate your own server and hold your staff's personal data, your service is the data controller and processor. Your responsibilities include:

  • Lawful basis: Establishing a lawful basis for processing staff data through MusterHub (typically employment contract or public task)
  • Staff privacy notice: Informing your staff what MusterHub collects and why, and how they can exercise their rights
  • Azure sub-processor agreement: Checking that your Azure subscription includes Microsoft's Data Processing Addendum
  • Data retention: Configuring appropriate retention periods within MusterHub's admin settings
  • Access control: Managing which of your administrators can access staff data within the platform
  • Backup and recovery: Setting up and testing backup procedures for your server and database
  • Breach notification: Maintaining an incident response process for any breach affecting your server

Managed hosting

Most of the above responsibilities remain with you as data controller. The main differences are:

  • We handle infrastructure, backups, monitoring and OS patching
  • You remain responsible for your staff privacy notice, admin access management and data retention configuration
  • You should document MusterHub as a data processor in your records of processing activities
  • A written Data Processing Agreement with MusterHub is required before going live

Leaving MusterHub

Self-managed

Your data stays in your own Azure tenant. When you finish with MusterHub, you can decommission the server at your own pace. We can provide guidance on the process, but there is nothing to export or retrieve from our side, because we never held it.

Managed hosting

When you leave, we will export your database in a portable SQL backup format and securely delete your data from our systems within 30 days of your departure date. We will confirm deletion in writing. If you need data in a different format, let us know before your end date and we will do what we can.

Software updates and support

We release updates to the MusterHub platform and provide support to both deployment types. For managed hosting, we apply updates and patches on your behalf.

For self-managed services, if a support issue requires access to your server environment, that access should be explicitly authorised by you. Any such access would be temporary, logged, and limited to what is needed to resolve the issue. If you want a formal written agreement covering support access, contact us and we will arrange one.

Data protection impact assessments

Depending on your service type, a DPIA may be required before deploying MusterHub. We can provide technical architecture documentation to support that process. Contact us at privacy@musterhub.app.

Sub-processors

MusterHub's central service

For operating the central routing service and push delivery, MusterHub uses:

  • Microsoft Azure (UK): hosting for the central routing service, governed by Microsoft's Data Processing Addendum
  • Google Firebase Cloud Messaging (FCM): delivery of push notifications from every MusterHub server, through MusterHub's Firebase project
  • Apple Push Notification service (APNs): onward delivery of those notifications to iOS devices

Self-managed: your service's sub-processors

As the data controller and processor for your own instance, your sub-processors typically include:

  • Microsoft Azure: infrastructure for your self-hosted MusterHub server, in the region you choose
  • Your SMTP provider: delivery of one-time login codes by email. MusterHub does not provide or process email on your behalf.

Your DPO should document these in your records of processing activities and check that appropriate agreements are in place with each provider. Push notifications go through MusterHub's Firebase project, so Google and Apple are listed under MusterHub's central service above.

Managed hosting: MusterHub's sub-processors for your instance

As your data processor, MusterHub uses the following sub-processors to run your hosted instance:

  • Microsoft Azure (UK): the virtual machine and storage your instance runs on
  • Google Firebase Cloud Messaging (FCM): delivery of push notifications, through MusterHub's Firebase project
  • Apple Push Notification service (APNs): onward delivery of those notifications to iOS devices

Push notifications

The published MusterHub app is registered to a single Firebase project owned by MusterHub, so push notifications from every MusterHub server, self-managed or managed, are sent through that project. Firebase delivers them to Android devices directly and to iOS devices through Apple's push service.

Each notification carries its title and text (for example, a turnout alert's details or a message subject) and the device's push token through Google's and, for iOS, Apple's infrastructure. Push tokens are stored on your server. MusterHub's Firebase credentials are held in your server's configuration only to send these notifications.

Wellbeing data

Wellbeing check-in responses are anonymised before storage. Individual responses are not linked to identifiable staff members.

Personal wellbeing journal entries are encrypted at rest using a service-specific key.

For self-managed services, that key lives in your Azure environment. Your Azure administrators can access it, but MusterHub cannot.

For managed hosting, that key lives in our Azure environment. Our Azure administrators have the technical means to access the key and, through it, the encrypted content. We do not access wellbeing journal content except where required to resolve a support issue you have explicitly authorised. If direct control over the wellbeing encryption key matters to your service, the self-managed deployment is the better fit.

What we recommend

For both deployment types:

  • Add a MusterHub section to your staff privacy notice explaining what the platform collects and why
  • Document MusterHub in your information asset register
  • Complete a DPIA if your DPO advises it, particularly given the wellbeing data involved

For self-managed services:

  • Document your sub-processors (Azure, APNs, FCM and your SMTP provider) in your records of processing activities

For managed hosting:

  • Sign a Data Processing Agreement with MusterHub before going live
  • Document MusterHub as a data processor in your records of processing activities
  • Document MusterHub's sub-processors (Azure UK, APNs, FCM) in those records

Questions

If you have questions about the technical architecture, need documentation for a DPIA or procurement process, or want to discuss a Data Processing Agreement for managed hosting, get in touch at privacy@musterhub.app.