TLS terminates where the data lives

Your customer's DPA says personal data is processed in Germany. Then their architect asks where TLS terminates, because on most stacks the answer is an edge POP chosen by anycast, which could be anywhere the CDN has a building.

On Hoody the proxy that serves your URLs runs on your server. Point api.yourcompany.com at the alias with a CNAME; Let's Encrypt issues the certificate, and the proxy on the Frankfurt box holds the private key and performs the handshake. There is no central Hoody tier in front of it and no edge network terminating on your behalf. The first machine to read a plaintext request is the one holding the data.

The architect's diagram gets shorter. Client, then your rack. Nothing in a third country sees a decrypted byte.