Sub-processors
Version 2026-11-12. We give customers 30 days’ notice of changes (DPA clause 2(d)).
| Provider | Purpose | Location / transfer mechanism |
|---|---|---|
| Cloudflare, Inc. | Hosting (Workers), DNS, CDN, bot protection (Turnstile), email routing | EU edge / global network; EU-US DPF + SCCs |
| Google Ireland Ltd. (Firebase) | Authentication and database (Firestore, location eur3 – Europe) | EU (eur3); SCCs/DPF for support access |
| Stripe Payments Europe, Ltd. | Payments, subscriptions and invoicing | Ireland/EU; DPF + SCCs |
| Sendinblue SAS (Brevo) | Transactional and consent-based marketing email | France/EU |
| OpenRouter, Inc. | AI model routing (paid tier, no-training providers only) | USA; SCCs |
| Google Ireland Ltd. (Gemini API, paid) | AI drafting fallback (paid tier, no training) | EU/US; DPF + SCCs |
| Telegram FZ-LLC | Opt-in notifications via @DPOneBot (non-sensitive summaries only) | UAE/global; opt-in only |