Sub-processors
The third parties we engage to deliver the service. Report data (the service) stays within the EU/EEA; payment is handled by a separate processor and never receives report content.
Last updated: 2026-08-04
Version 1.0 · effective 2026-09-04. The DPA incorporates this list as published on its effective date, so the version you agreed to does not change when this page does. Past versions are listed at the bottom.
| Sub-processor | Purpose | Location | Data scope |
|---|---|---|---|
| Bunny.net d.o.o. | CDN & DNS (content delivery, EU-only edge serving) | Slovenia (EU/EEA) | Requests in transit; no report content stored at the edge |
| Hetzner Online GmbH | Hosting / application & database infrastructure | Finland (EU/EEA) | Report data at rest (encrypted in transit) |
| Stripe Payments Europe, Ltd. | Payment processing (subscriptions/billing) | Ireland (EU) — parent Stripe, Inc. is US-based | Billing/customer account data only — never report content |
| One.com (team.blue) | Transactional email (case notifications) | Denmark (EU/EEA) | Recipient email address + notification metadata |
AI processing
AI-assisted categorisation runs on our own EU infrastructure; no third-party or US AI provider receives report content.
Changes to this list
We will update this page before engaging a new sub-processor or replacing an existing one. Customers with an active Data Processing Agreement may object to a new sub-processor on reasonable data-protection grounds as set out in the DPA.
Every change carries a new version and effective date. To check whether the list has moved since you signed, compare the version above with the one recorded in your agreement.
Version history
| Version | Effective | Change |
|---|---|---|
| 1.0 | 2026-09-04 | First versioned publication. The list itself is unchanged; previously it was published without a version or effective date. |
Questions: mikael@manpro.se.