Sub-processors of GAdvisory
Which companies process personal data for GAdvisory, and who receives data from it for their own purposes.
These are the rows of our sub-processor list that apply to GAdvisory. The whole list also shows who we have removed and how a change is announced. Where this page and the processing annex of GAdvisory differ, the annex wins.
Sub-processors
| Company | What it does | Where | Services | Transfers |
|---|---|---|---|---|
| IONOS SE, Elgendorfer Straße 57, 56410 Montabaur | Server hosting, including the virtual server on which our own mail server runs. | Germany | Every hosted service | No third country |
| Cloudflare, Inc. | DNS hosting for our domains and nothing else. It answers which address belongs to a name. None of our services' pages, mail, files or other traffic passes through it, and no content of a service reaches it. | United States | Every hosted service | The EU-US Data Privacy Framework where Cloudflare is certified under it, otherwise standard contractual clauses |
| Sentry (Functional Software, Inc.) | Error reports, received on its EU data region from the services named here and from no others. What each service sends is set out in that service's annex, and for GOpenCSR, which has no annex, in its privacy notice. | United States, EU data region | GAdvisory, GAnalytics, GOpenCDR, GOpenCNR, GOpenCSR, Contribution Checker, Discord Tickets | The EU-US Data Privacy Framework (Functional Software, Inc. is certified) |
| OpenRouter, Inc., routing to Google (Gemini) | The AI features, which are enabled on the hosted service. | United States | GAdvisory | Standard contractual clauses in OpenRouter's data processing agreement; Google LLC is certified under the EU-US Data Privacy Framework |
| GitHub, Inc. | Private fixes (Advisory Patch) created in GitHub mode, and only those: it stores the private copy of the repository and the invitations to it, in the GitHub organisation we keep for private fixes. In the native mode, which we host ourselves, GitHub receives nothing. | United States | GAdvisory | The EU-US Data Privacy Framework (GitHub, Inc. is certified) |
Receive data, but are not sub-processors
These receive personal data for their own purposes, because somebody asked for it, and not to process it on our behalf or yours.
| Recipient | What reaches it, and why | Services |
|---|---|---|
| GitHub, Inc. (United States, certified under the EU-US Data Privacy Framework) | An advisory, when you publish it to GitHub Security Advisories. For private fixes in GitHub mode it is our sub-processor, as set out above. | GAdvisory |
| The CVE Program | An advisory, when you publish it through the CVE Program. | GAdvisory |
| The push service your browser nominates (Google, Mozilla or Apple) | Where a user enables browser push, the endpoint and the timing. The content is encrypted to the browser's keys and does not reach it. | GAdvisory |