Sub-processors
These are the services that process customer data on our behalf, and why.
| Sub-processor | Purpose | Data involved | Location |
|---|---|---|---|
| Hetzner Online GmbH | Application and database hosting | All service data | Germany (EU) |
| Cloudflare, Inc. | DNS, TLS and network security in front of the application | Traffic metadata | Global edge; EU/UK primary |
| Postmark (ActiveCampaign, LLC) | Transactional email delivery of reports and notifications | Recipient names and email addresses; report attachments in transit | USA (IDTA/SCCs) |
| Stripe Payments Europe, Ltd | Subscription billing and VAT | Billing contact and payment details (we never hold card numbers) | EU/USA (SCCs) |
| Anthropic, PBC | Drafting the plain-English report commentary from aggregated metrics | Aggregated report figures only; no end-user personal data; no training on customer data | USA (IDTA/SCCs) |
| Functional Software, Inc. (Sentry) | Error monitoring | Technical error context, scrubbed of tokens and personal data | USA (IDTA/SCCs) |
Google (Search Console, Analytics, PageSpeed Insights) is not a sub-processor: it is the source our customers connect, accessed with their authorisation, under Google's own terms.