---
title: Sub-processors
lang: en
path: /legal/subprocessors
alternate_de: /de/rechtliches/unterauftragsverarbeiter
updated: 2026-10-01
---

# Sub-processors

Last updated: 1 October 2026

This list is Annex 3 of our [Data Processing Agreement](/legal/dpa). We announce any addition or replacement at least 30 days in advance by email to account holders and on this page; you may object as described in section 6.2 of the DPA.

## May process API content — tier scope below

| Sub-processor | Service | Location of processing | Safeguard |
|---|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Hosting of the websites (including the dashboard), API gateway, database and encrypted backups | EU (data centre in Helsinki, Finland) | Provider's standard Art. 28 GDPR agreement required before customer-data processing; ISO/IEC 27001-certified data centres |
| DataCrunch Oy (trading as Verda), Helsinki, Finland | GPU servers for model inference | Finland (EU) | Art. 28 GDPR data processing terms; ISO/IEC 27001 and SOC 2 Type II (per provider) |
| Lium (lium.io), with independent third-party GPU providers | On-demand GPU inference for opted-in Global keys when spare EU capacity is busy | worldwide (third-party GPU providers) |  Transfers outside the EU/EEA happen only for keys you opted in; you are responsible for not sending personal data on such keys unless an adequate transfer basis applies for your use. The switch itself is not a transfer basis under Chapter V GDPR. |

EU-tier requests always stay in the EU. Without worldwide opt-in, Global requests also stay in the EU. Request and response content is not stored on any node; this applies to EU capacity and Global overflow alike.

## Account, billing and identity providers — no API content

The providers below may receive account, billing or sign-in data, but never API request content. Their roles depend on the service: some act as processors on our instructions; Stripe and Google act as independent controllers for their own payment or identity services. See the [Privacy Policy](/legal/privacy) for details.

| Provider | Service | Location | Role |
|---|---|---|---|
| Stripe Payments Europe, Ltd., Dublin, Ireland | Payments, tax calculation and invoices | EU; transfers to Stripe, Inc. (USA) under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses | Independent controller for payment processing; processor for invoicing |
| Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, France | Service emails (sign-in links, receipts and notices); planned, not in use at present | EU (Paris, France) | Processor, once enabled; its Art. 28 GDPR agreement is concluded before first use |
| Google Ireland Limited, Dublin, Ireland | Google sign-in; verified email and stable account ID only | EU; transfers to Google LLC (USA) may occur under the EU-U.S. Data Privacy Framework | Independent controller for identity services |

## Global tier — current status

The Global tier first uses spare EU capacity, with lower priority than EU-tier requests. When that capacity is busy, Global requests may use on-demand GPU capacity rented through Lium (lium.io). Independent third-party providers operate the GPU hardware in various countries, including outside the EU/EEA. Processing outside the EU happens only for API keys whose customer has explicitly enabled the "Allow worldwide processing" switch. Without that opt-in, Global requests stay on EU capacity and may be queued or rejected with a retryable error when busy. EU-tier requests always stay in the EU and have priority. Existing customers keep EU-only processing unless they opt in for the individual key. Request and response content is not stored on any node (zero payload retention). The existing 30-day notice and objection process still applies to new content sub-processors. This list does not assert Lium certifications or signed Standard Contractual Clauses.

## Change history

| Date | Change |
|---|---|
| 27 Sep 2026 | First version |
| 28 Sep 2026 | Hetzner service scope and safeguard reference clarified; no provider added or removed |
| 30 Sep 2026 | Google sign-in and account-provider roles clarified; Hetzner data-centre location (Helsinki) and Scaleway status (not yet in use) stated; no provider added or removed |
| 1 Oct 2026 | Lium and independent third-party GPU providers added for opted-in Global overflow; EU-only defaults, EU-tier priority, zero payload retention and transfer conditions clarified |

[Previous versions](/legal/subprocessors/archive).