How is user data protected?

Stapes's physical infrastructure is hosted and managed within Google Cloud secure data centres and utilises the Google Cloud Platform (GCP) technology.

GCP provides built-in protection and global network that Google uses to protect your information, identities, applications, and devices.

All GTM Server containers are isolated from one another for security purposes. Stape uses Google Kubernetes Engine with recommended security settings to ensure that access is properly restricted for all customers.

And if you are on Stape Europe:

Using EU-owned and hosted proxy server is a GDPR-compliant way to use Google Analytics. 

Stape Europe is a European company that uses a European cloud server provider to run your server GTM container. But only using Stape Europe for sGTM won't make your Google Analytics GDPR compliant. You also need to pseudoanonimize user data before sending it to GA. It needs to be done manually using the server GTM interface.