Current sub-processors (as at 31 October 2026)
Sub-processors of Customer Personal Data
| # | Sub-processor | Purpose | Personal data | Location | Transfer mechanism | Status |
|---|---|---|---|---|---|---|
| 1 | Cloudflare, Inc. (USA) | Edge network and TLS; the consent API (Workers); database connection pooling; tunnels to the Processor's servers; secret store for key-encryption keys; Workers logs; encrypted off-host backup copies of the database in object storage (R2, EU-jurisdiction bucket) | Full IP address and user agent transiently on every request; country/region derived from them; consent request bodies in transit; Cloudflare's request metadata and logs; encrypted backup copies of everything in clause 2's "stored" row (encrypted before upload; Cloudflare holds no decryption key) | Processing at the edge location nearest each End User; Cloudflare's logs and request metadata may be processed in the United States and other countries | Cloudflare Data Processing Addendum, incl. SCCs and UK Addendum | Engaged |
| 2 | Contabo GmbH (seat: Munich, Germany) — virtual private server | Infrastructure hosting for the database the Processor operates (consent ledger, salts, wrapped keys, configurations, audit log, backups), the scanner service and the dashboard. Contabo does not administer the database and has no logical access to it | Everything in clause 2's "stored" row, at rest | European Union (Contabo "Hub Europe" location) | Contabo data processing agreement; no third-country transfer | Engaged |
| 3 | OpenTimestamps public calendar servers (no processor relationship; listed for transparency) | Anchoring of digests of each Website's log | A hash only; no personal data | Public network | None required | Engaged |
Providers that never receive Customer Personal Data (the Processor's own controller-side vendors, governed by the Privacy Policy, not by this DPA): the payment gateway we use for checkout; the transactional email provider we use for account and billing notices, once engaged; Cloudflare Turnstile for the website's free scanner; and the analytics and advertising tools on trustcookies.com (Google and Microsoft, and Meta and LinkedIn if we use their advertising tags). No End User data from the Customer's Websites is ever sent to any of them.
Also disclosed (not sub-processors): the Processor's own personnel access stored data remotely from India (clause 6.1); the c15t open-source consent engine runs on the End User's device only and sends nothing to its authors.