| Hetzner Online GmbH | Application hosting and storage (production) | All Customer Data, application logs | EU — Germany (application server: Nuremberg / nbg1; object storage: Falkenstein / fsn1) | Within EU/EEA — no third-country transfer; Hetzner DPA (Art. 28) |
| Cloudflare, Inc. (R2) | Encrypted off-site database and object-store backups | Encrypted copies of all Customer Data; Cloudflare does not hold the decryption key | R2 bucket configured for EU jurisdiction | Cloudflare DPA; Cloudflare, Inc. holds an active EU-U.S. DPF certification (adequacy, Art. 45) — EU SCCs retained as backstop |
| Auth0 (Okta, Inc.) | Authentication and identity | Authentication credentials, profile metadata (email, name) | EU tenant | Auth0/Okta DPA; US parent Okta, Inc. holds an active EU-U.S. DPF certification covering Auth0, LLC (adequacy, Art. 45) — EU SCCs retained as backstop |
| AWS SES (Amazon Web Services EMEA) | Transactional email delivery (account, verification, notifications) | Recipient email address, message content | EU region | AWS DPA; US parent certified under the EU-U.S. DPF (Amazon.com, Inc., covering Amazon Web Services, Inc.) (adequacy, Art. 45) — EU SCCs retained as backstop |
| HubSpot, Inc. | In-app support ticketing (CRM) | Support-requester email + name + support-ticket content only | US (app-na2, North America) | HubSpot DPA; HubSpot, Inc. holds an active EU-U.S. DPF certification (adequacy, Art. 45) — EU SCCs (Module 2) retained as backstop, single instrument |
| PostHog (EU Cloud, PostHog Inc.) | Anonymous visit counts on our public websites; not used in the application | Usage events, IP address, device/browser metadata | EU (eu.posthog.com) | EU region — no third-country transfer; PostHog DPA |
| Stripe Payments Europe, Ltd. | Payment processing and invoicing | Billing data, payment-method tokens | EU + US | Stripe DPA; US entity Stripe, LLC holds an active EU-U.S. DPF certification (adequacy, Art. 45) — EU SCCs retained as backstop (activation in progress) |