Subprocessors
Last updated 28 September 2026
New subprocessors are listed here 30 days before they start, as the data processing agreement says. Cloudflare, Polar, Fly.io and OpenRouter are US companies; Amazon has a US parent.
Webdock
- Company
- Webdock.io ApS, Denmark
- Purpose
- Primary server
- Data
- All data
- Location
- Denmark
Hetzner
- Company
- Hetzner Online GmbH, Germany
- Purpose
- Standby server and check location
- Data
- All data
- Location
- Germany
Cloudflare
- Company
- Cloudflare, Inc., United States
- Purpose
- Network, load balancing, certificates, backups and form checks
- Data
- All traffic; backups
- Location
- Worldwide; backups in Western Europe
- Transfer
- EU-US Data Privacy Framework and Standard Contractual Clauses
Amazon Web Services
- Company
- Amazon Web Services EMEA SARL, Luxembourg
- Purpose
- Email (Amazon SES), and receiving and keeping mail to support for 30 days (Amazon S3)
- Data
- Recipient, subject, message and delivery reports; the reader's IP address and browser for open counts; mail to support as it arrived
- Location
- Frankfurt, Germany
Polar
- Company
- Polar Software, Inc., United States
- Purpose
- Merchant of record for Hobby and Pro
- Data
- Name, email, billing address and payment
- Location
- United States
- Transfer
- Standard Contractual Clauses
Fly.io
- Company
- Fly.io, Inc., United States
- Purpose
- Check locations in Ashburn, Virginia, Singapore and Sydney, and the places an account adds
- Data
- Monitor settings; hosts of failed checks in logs
- Location
- United States, Singapore and Australia; the United Kingdom, France, Canada, Brazil, South Africa or Japan for places an account adds
- Transfer
- EU-US Data Privacy Framework
OpenRouter
- Company
- OpenRouter, Inc., United States
- Purpose
- Incident drafts on Pro, only when requested; labelling new mail and messages to support, passed on to OpenAI or Microsoft Azure with data collection denied
- Data
- Incident text, monitor names and URLs without query strings, failed checks and deploy markers; a new support message's subject and text, the sender's domain and plan
- Location
- United States
- Transfer
- Standard Contractual Clauses
Sign-in providers
Google and GitHub are used only if you sign in with them, and act as independent controllers.