Subprocessors

1.Current subprocessors

As at 21 September 2026. The list is split by the role TracePath plays, because that determines which agreement governs the provider. Rows marked conditional only process data when the feature named is in use; if you never sign in with Google, for example, Google never receives anything about you.

Subprocessors of Customer telemetry — Annex 3 of the DPA

These process Customer Personal Data contained in telemetry, where TracePath acts as processor. They are the providers the change-notice and objection right in section 3 of this page, and section 7 of the DPA, applies to.

Processors of account, billing and website data — controller-side

These never receive Customer telemetry. They process account, billing, sign-in or marketing-website data, for which TracePath is the controller; they are covered by section 7 of the Privacy Policy rather than by the DPA.

2.Where your data lives

All production systems — the application, the API, the telemetry endpoint, PostgreSQL, ClickHouse and object storage — run on infrastructure provided by Hetzner Online GmbH (Industriestraße 25, 91710 Gunzenhausen, Germany) in Helsinki, Finland (EU).

That is inside the European Union. Storing customer telemetry there means no cross-border transfer is involved in the storage itself, which materially simplifies the transfer analysis for EU customers. The provider maintains an ISO/IEC 27001 certified information security management system covering the Helsinki site, and we have a data processing agreement with it under Article 28 GDPR.

We do not currently offer a data residency option outside the EU. If you need one, talk to [email protected] before you commit to a plan rather than after.

3.Notice of changes and your right to object

1. We publish intended additions and replacements here, and email the owners of every affected organisation, at least 30 days before the new subprocessor starts processing customer data.
2. To receive these notices at a specific address — a security or procurement mailbox rather than the account owner — write to [email protected] and we will add it.
3. You may object on reasonable data-protection grounds within the notice period. We will discuss it with you in good faith and look for an alternative.
4. If we cannot provide the service without that subprocessor and cannot offer a commercially reasonable alternative, you may terminate the affected part of the service without penalty and receive a pro-rata refund of prepaid fees. The full mechanism is in section 7 of the DPA.
5. Where a change is required to keep the service running or secure — for example an emergency migration away from a failing provider — we may act on shorter notice and will explain why at the time.

4.How we choose a subprocessor

Before a provider goes on this list we check that:

• it is genuinely necessary — we would rather run one fewer service than add one more party to the chain;
• it will receive the minimum data needed for its function, and no telemetry unless its function requires it;
• there is a written agreement containing the Article 28(3) GDPR terms, and a documented transfer mechanism where it processes outside the EEA;
• it publishes its own subprocessor list and security documentation, so the chain stays inspectable;
• an EU-based or EU-hosted option was considered first.

5.What is not on this list

We do not use advertising networks, data brokers, lead-enrichment services, customer data platforms or third-party session recording on our own properties, so none appears here. We do not send customer telemetry to any AI or machine-learning provider.

Our accountant and, when engaged, external legal advisers may see billing records in the course of their professional work. They act under statutory professional confidentiality rather than as subprocessors of customer telemetry, and they never have access to the Service.

6.Contact

Questions, objections, requests for a provider’s transfer documentation, or a request to be added to the change-notice list: [email protected].