Sub-processors and service providers
European-only. Every vendor in the data path is EU-incorporated.
Sub-processors
Section titled “Sub-processors”These services process Customer Data on your behalf. All are EU-incorporated and covered by our DPA. This is the list referenced in DPA section 6.2.
| Service | Purpose | Location |
|---|---|---|
| Scaleway | Compute, object storage, managed PostgreSQL, container registry, transactional email, observability | Paris, France |
| Hetzner | Encrypted backup storage | Falkenstein, Germany |
| Mollie | Payment processing | Amsterdam, Netherlands |
| Crisp | In-app support chat | Nantes, France |
Other service providers
Section titled “Other service providers”These services support our operations but do not process Customer Data.
| Service | Purpose | Location | Jurisdiction |
|---|---|---|---|
| Proton Mail | Corporate email (@codebahn.net) | Geneva, Switzerland | EU adequacy decision |
| Updown.io | Status page and uptime monitoring | France | EU |
| Plausible | Website analytics (no personal data collected) | Falkenstein, Germany | EU (Estonia) |
Infrastructure details
Section titled “Infrastructure details”Primary infrastructure runs in Scaleway’s fr-par region (Paris). Backups live on Hetzner in Falkenstein, Germany: a separate provider in a separate region. They run daily, are encrypted client-side with Restic, and are verified weekly.
Data is encrypted in transit (TLS 1.2+, TLS 1.3 where supported) and at rest (AES-256). Server logs with IP addresses are kept for 30 days. Billing records are kept for seven years, as Swedish bookkeeping law requires.
Last reviewed: June 2026.