Last updated: September 20, 2026· 2026.09
As of version 2026.09. Pursuant to section 6 of the Data Processing Agreement, your authorisation is deemed granted for the following service providers. We announce changes at least 30 calendar days in advance in the application; you may object.
| Provider | Seat | Purpose of processing | Categories of data | Third-country safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Falkenstein, Deutschland (EU) | Hosting and operation (server, database, volumes) | all data processed on your behalf | EU |
| Cloudflare, Inc. | USA | Bot protection (Turnstile) on public forms | technical request data (IP, timestamp) | EU-US Data Privacy Framework |
| Sentry | USA | Error tracking (server and browser, where enabled) | error data, may contain user identifiers | EU-US Data Privacy Framework; EU hosting option |
| Object storage (S3-compatible) | per configuration | Attachment storage | feedback attachments | EU region or SCCs |
| SMTP relay | per configuration | Transactional email delivery | email addresses, message content | EU or SCCs |
| IMAP host | per configuration | Feedback inbox polling | messages, attachments, credentials (encrypted) | EU |
| Google (push service) | USA | Delivery of web push notifications in Chrome | push endpoint, payload | EU-US Data Privacy Framework |
Customer-designated AI providers (bring your own key) are not sub-processors of the Provider; they are engaged by the workspace operator under its own responsibility (see section 13 of the DPA).