Sub-processors

The current sub-processor roster. The canonical, legally-binding list is in spec 12 §5 and published in the Datenschutz at nowyourlink.com/legal/datenschutz. The table here is the operator overview — it shows what each processor does and which data category it touches, so an engineer touching the relevant code path knows the contract.

Sub-processor	Purpose	Data category	Region	Transfer mechanism
Stripe Payments Europe Ltd.	Card processing, PaymentIntents, invoicing, KYC via Stripe Identity	Payment data, identity documents, billing address, USt-IdNr.	IE (EU) + US (Stripe Inc.)	SCCs
Cloudflare, Inc.	Edge runtime (Workers, DO, D1, R2, KV, Workflows), DNS, WAF, Pages	All platform traffic, request logs, R2-stored creative	US (anycast EU PoP)	SCCs + DPA
Resend (`resend.com`)	Transactional email — invoices, KYC reminders, account notifications	Email address, transactional content	US	SCCs
Functional Software, Inc. (Sentry)	Error tracking and per-classifier alerting	Stack traces, request IDs, scrubbed request bodies	US (EU DSN available — to be migrated, see spec 12 §5 carry-forward)	SCCs
GitHub, Inc. (CI)	Source hosting + CI runners	Repository content, CI logs, deploy artefacts	US	SCCs

Inclusion of a sub-processor in this list does NOT imply consent on behalf of advertisers — advertiser-facing consent lives in the per-advertiser DPA (see DPA).

Adding or removing a sub-processor

Material changes follow the procedure in spec 12 §5:

Open a PR against packages/legal/templates/{en,de}/datenschutz.md and this page in lock-step.
Notify existing DPA-signed advertisers via email at least 30 days before the change takes effect (template in packages/legal/templates/{en,de}/sub-processor-notice.md).
CI gate (see spec 12 §1) blocks merge if any company-config field is empty.

See also

Spec — 12 — Legal & Compliance §5 (sub-processor list, transfer mechanisms, carry-forwards)
DPA — how the list is bound to advertisers
Data rights flow — how a user enforces DSGVO rights against the platform AND its sub-processors