Subprocessors
Every company that touches your data on our behalf, what it does, and where. No account is needed to read this page, because a list you can only see after buying is not much use for deciding whether to buy.
We give at least 30 days' notice by email before adding or replacing any of them — see section 7 of the data processing agreement for what you can do about it.
Your instance and its backups
| Who | What they do | Where | What they can see |
|---|---|---|---|
| Hetzner Online GmbH | The servers your instance runs on, its network, and the DNS for the platform's own names | Germany and Finland | Everything on the machine, in the way any hosting provider physically can. Nothing is decrypted for them, and they have no account on it. |
| Hetzner Online GmbH | Storage for the first copy of your nightly backups | Germany or Finland | Encrypted archives only. The keys are ours and are not theirs. |
| Scaleway SAS | Storage for the second, independent copy of your nightly backups | France (Paris) | Encrypted archives only, under a separate credential from the first copy. |
Both backup copies are with European companies, and that is a deliberate choice rather than a coincidence of where the data centres are. A provider with a United States parent can be reached by United States law wherever it stores the bytes, and this is the copy that holds every line of your source code. So the second copy is Scaleway — a French company, a subsidiary of the French group Iliad — rather than a US-parented provider's European region, which is what it used to be going to be.
Email and payments
These two are the reason this page does not simply say "everything stays in the EU". Both are groups with United States parents, so we name them and say what they see. They are also the reason the paragraph above says what it says: having had to correct that claim once, we were not going to introduce the same problem into the backups.
| Who | What they do | Where | What they can see |
|---|---|---|---|
| Postmark (ActiveCampaign, LLC) | Delivering email: the platform's own notifications to you, and the mail your forge sends to its users | United States | Recipient addresses, subjects, and message contents of the mail they deliver — a backup-failure notice, a deletion countdown, an issue notification from your forge. Not your repositories. |
| Stripe (Stripe Payments Europe, Ltd., part of a United States group) | Taking payment as merchant of record, issuing invoices, handling tax | Ireland, with processing in the United States | Your billing details and card, which never reach us; your name, email address and what you bought. |
Transfers to these are made under the European Commission's standard contractual clauses.
One more, and it is on every page
This portal loads its single JavaScript library from unpkg, a public content delivery network operated by Cloudflare, Inc. (United States). That is not a processor we send data to — but your browser fetches a file from them on every page of this portal, so they see your IP address and the fact that you visited.
It is a dependency we should not have on a product sold on European sovereignty, and serving the file ourselves removes it. It is listed here because it is invisible otherwise, and a subprocessor page that omits the one thing a visitor cannot see for themselves is worth very little.
Who is not on this list
There is no analytics provider, no advertising network, no session recorder, no chat widget, no error-tracking service, no customer relationship system, and no artificial intelligence service of any kind. Support email is read by a person, on a mail account belonging to the provider.