Sub-processors — 2026-09-30 (archived)

Last updated: 30 September 2026

This list is Annex 3 of our Data Processing Agreement. We announce any addition or replacement at least 30 days in advance by email to account holders and on this page; you may object as described in section 6.2 of the DPA.

May process API content (both tiers)

Sub-processor	Service	Location of processing	Safeguard
Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany	Hosting of the websites (including the dashboard), API gateway, database and encrypted backups	EU (data centre in Helsinki, Finland)	Provider's standard Art. 28 GDPR agreement required before customer-data processing; ISO/IEC 27001-certified data centres
DataCrunch Oy (trading as Verda), Helsinki, Finland	GPU servers for model inference	Finland (EU)	Art. 28 GDPR data processing terms; ISO/IEC 27001 and SOC 2 Type II (per provider)

At present, API content of both tiers never leaves the European Union.

Account, billing and identity providers — no API content

The providers below may receive account, billing or sign-in data, but never API request content. Their roles depend on the service: some act as processors on our instructions; Stripe and Google act as independent controllers for their own payment or identity services. See the Privacy Policy for details.

Provider	Service	Location	Role
Stripe Payments Europe, Ltd., Dublin, Ireland	Payments, tax calculation and invoices	EU; transfers to Stripe, Inc. (USA) under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses	Independent controller for payment processing; processor for invoicing
Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, France	Service emails (sign-in links, receipts and notices); planned, not in use at present	EU (Paris, France)	Processor, once enabled; its Art. 28 GDPR agreement is concluded before first use
Google Ireland Limited, Dublin, Ireland	Google sign-in; verified email and stable account ID only	EU; transfers to Google LLC (USA) may occur under the EU-U.S. Data Privacy Framework	Independent controller for identity services

Global tier — current status

The Global tier currently runs on the same EU infrastructure and sub-processors as the EU tier, with lower priority. Before any Global-tier traffic is processed outside the EU, we will add the operators to this list with their locations and transfer safeguards, announce the change at least 30 days in advance, and route a key's traffic there only after you have explicitly opted in for that key.

Change history

Date	Change
27 Sep 2026	First version
28 Sep 2026	Hetzner service scope and safeguard reference clarified; no provider added or removed
30 Sep 2026	Google sign-in and account-provider roles clarified; Hetzner data-centre location (Helsinki) and Scaleway status (not yet in use) stated; no provider added or removed