Subprocessors
Last updated: 6 July 2026
DataRecs uses the following third-party subprocessors to deliver its services. Each subprocessor is bound by contractual obligations to protect your data. This page is the authoritative list referenced by our Privacy Policy; changes are recorded in the change log below.
Platform subprocessors
These providers are involved in operating the DataRecs reconciliation platform.
| Subprocessor | Purpose | Location of processing | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Cloud infrastructure and hosting (customer data at rest and in processing) | Falkenstein, Germany | Not applicable — EU processing under UK adequacy regulations for the EEA |
| Civo Ltd | Cloud infrastructure and hosting (customer data at rest and in processing) | London, United Kingdom | Not applicable — UK processing |
| Google Cloud Platform (Google LLC) | Key management (KMS) only — cryptographic key operations; no customer data is hosted or stored on Google Cloud | United States / global | Appropriate safeguards under UK GDPR Article 46 |
| Cloudflare, Inc. | Content delivery network, DNS, edge routing, and security protection | Global edge network | Appropriate safeguards under UK GDPR Article 46 |
| WorkOS, Inc. | Authentication and single sign-on | United States | Appropriate safeguards under UK GDPR Article 46 |
| Resend (Plus Five Five, Inc.) | Transactional email delivery (account and run notifications) | United States | Appropriate safeguards under UK GDPR Article 46 |
Website and marketing subprocessors
These providers process limited data in connection with our public website and marketing communications only — not customer platform data.
| Subprocessor | Purpose | Location of processing | Transfer mechanism |
|---|---|---|---|
| Kit (Kit.com) | Broadcast email communications and newsletters (marketing subscribers only) | United States | Appropriate safeguards under UK GDPR Article 46 |
| Google Firebase (Google LLC) | Website feature-flag configuration (Remote Config) | United States / global | Appropriate safeguards under UK GDPR Article 46 |
Change notification
We record every change to this list in the change log below, including the date it takes effect. Customers with a Data Processing Agreement that requires advance notice of subprocessor changes will be notified in accordance with that agreement.
Change log
- 6 July 2026 — Corrected and republished the subprocessor list: added Hetzner Online GmbH (hosting, Germany) and Civo Ltd (hosting, United Kingdom); reclassified Google Cloud Platform as key management (KMS) only, not hosting; removed Stripe (no payment processing integration is currently in use); added Google Firebase Remote Config disclosure for the website.