Sub-processors
As of 2026-06-12
This list is kept public under GDPR Art. 28(2) and EDPB Opinion 22/2024. Changes are announced at least 30 days in advance.
| Provider | Function | Location | Data categories | Legal basis |
|---|---|---|---|---|
| Railway Corp. | Application hosting | US-West (Oregon) |
| Art. 46 EU-SCC 2021/914 (DPA des Anbieters) |
| MongoDB Atlas | Database storage | US-West (Oregon) |
| Art. 45 DPF (Selbst-Zertifizierung); Art. 46 EU-SCC 2021/914 Fallback |
| Resend Inc. | Transactional email | USA (AWS) |
| Art. 45 DPF (Selbst-Zertifizierung 13.03.2025); Art. 46 EU-SCC 2021/914 + TIA-003 Fallback |
| Cloudflare, Inc. (R2) | Object storage (tenant logos) | USA / EU edge |
| Art. 45 DPF (Selbst-Zertifizierung); Art. 46 EU-SCC 2021/914 Fallback |
How we notify of changes
Tenants automatically receive an email notification under GDPR Art. 28(2) at least 30 days before any sub-processor change. No separate subscription needed.
History
- Railway Corp. — Added on 2026-01-01 (US-West (Oregon))
- MongoDB Atlas — Added on 2026-01-01 (US-West (Oregon))
- Resend Inc. — Added on 2026-01-01 (USA (AWS))
- Cloudflare, Inc. (R2) — Added on 2026-05-15 (USA / EU edge)
Questions? See the privacy notice or the DPA.