Sub-processors
Who we engage to process personal data on your behalf, service by service, who receives data only for their own purposes, and who we have stopped using.
What this list is
This is the list the data processing agreement refers to. A sub-processor is a company we use to process personal data on your behalf. The agreement gives us general authorisation to engage them; this page names each one, says what it does and where it is, and shows the ones we have removed. Each hosted service also shows the rows that apply to it beside its other legal documents.
If this page and a service's own annex differ about that service, the annex wins, as the agreement says. We tell you before we add or replace a sub-processor, with a reasonable period to object. Every version of this page is kept in the document archive.
Sub-processors
| Company | What it does | Where | Services | Transfers |
|---|---|---|---|---|
| IONOS SE, Elgendorfer Straße 57, 56410 Montabaur | Server hosting, including the virtual server on which our own mail server runs. | Germany | Every hosted service | No third country |
| Cloudflare, Inc. | DNS hosting for our domains and nothing else. It answers which address belongs to a name. None of our services' pages, mail, files or other traffic passes through it, and no content of a service reaches it. | United States | Every hosted service | The EU-US Data Privacy Framework where Cloudflare is certified under it, otherwise standard contractual clauses |
| Sentry (Functional Software, Inc.) | Error reports, received on its EU data region from the services named here and from no others. What each service sends is set out in that service's annex, and for GOpenCSR, which has no annex, in its privacy notice. | United States, EU data region | GAdvisory, GAnalytics, GOpenCDR, GOpenCNR, GOpenCSR, Contribution Checker, Discord Tickets | The EU-US Data Privacy Framework (Functional Software, Inc. is certified) |
| OpenRouter, Inc., routing to Google (Gemini) | The AI features, which are enabled on the hosted service. | United States | GAdvisory | Standard contractual clauses in OpenRouter's data processing agreement; Google LLC is certified under the EU-US Data Privacy Framework |
| OpenRouter, Inc., routing to Groq LLC | AI tasks, only where a project enables one, which is off by default for every task. Where it is off, OpenRouter receives nothing. | United States | Contribution Checker | Standard contractual clauses in OpenRouter's data processing agreement |
| Stripe Payments Europe, Limited | Two things, and the annex of GPlatform Billing says which is which: our processor for the customer record it holds for us, for issuing and numbering invoices, and for the billing portal; a controller in its own right for the payment instrument (the card or account you pay with) and for screening a payment for fraud. | Ireland | GPlatform Billing | Within Stripe's group, the safeguards in Stripe's data processing agreement |
| GitHub, Inc. | Private fixes (Advisory Patch) created in GitHub mode, and only those: it stores the private copy of the repository and the invitations to it, in the GitHub organisation we keep for private fixes. In the native mode, which we host ourselves, GitHub receives nothing. | United States | GAdvisory | The EU-US Data Privacy Framework (GitHub, Inc. is certified) |
A GitHub organisation of your own. Where your organisation has a private fix in GAdvisory made in a GitHub organisation of its own instead, the copy sits in your own account with GitHub, under your terms with GitHub, and GitHub is not our sub-processor for it.
Our own hardware in Germany is not a sub-processor, and is listed so that the list says where data sits: several services run on it, our mail runs on our own mail server and our file storage is our own MinIO.
Receive data, but are not sub-processors
These receive personal data for their own purposes, because somebody asked for it, and not to process it on our behalf or yours.
| Recipient | What reaches it, and why | Services |
|---|---|---|
| GitHub, Inc. (United States, certified under the EU-US Data Privacy Framework) | You install a GitHub App on your own repositories, and identities come from GitHub. | Contribution Checker |
| GitHub, Inc. (United States, certified under the EU-US Data Privacy Framework) | An advisory, when you publish it to GitHub Security Advisories. For private fixes in GitHub mode it is our sub-processor, as set out above. | GAdvisory |
| The CVE Program | An advisory, when you publish it through the CVE Program. | GAdvisory |
| The push service your browser nominates (Google, Mozilla or Apple) | Where a user enables browser push, the endpoint and the timing. The content is encrypted to the browser's keys and does not reach it. | GAdvisory |
| Discord Inc. (United States) | It is the source of the data, which exists in Discord because the members of your server put it there, under Discord's terms with them. | DAnalytics, Discord Tickets, YAGPDB |
Removed
| Company | What it did | Where it stands |
|---|---|---|
| Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany | Hosted servers for some services. | We no longer use it: it hosts and processes nothing for us. The data processing agreement and the annexes no longer name it, and customers are told with the notice of the version of the agreement that removes it. |
Questions
Write to contact@gplatform.org.