Short version: backup, server and website data stays on hardware we own in Los Angeles. The services below receive only the operations, payment, domain or phone data each one needs. We tell you 30 days before adding one, and you can object.
#1. What this list covers
A sub-processor is a company we engage that processes personal data on our behalf. This list covers both kinds of personal data we handle: data we process for you under our Data Processing Agreement, and the account data we control under our Privacy Policy. It is Annex 3 of the Data Processing Agreement.
None of these companies can read restic vaults or ServerCrate Backup data. Those are encrypted on your device before upload, and the keys never reach us.
#2. Current sub-processors
| Sub-processor | What it does for us | Personal data it receives | Where | Transfer mechanism |
|---|---|---|---|---|
| Cloudflare, Inc. | Turnstile bot check on the portal sign-up form only. It loads only when someone starts filling in the form. | IP address and browser signals of sign-up visitors. | United States and Cloudflare's global network | EU-US Data Privacy Framework. EU SCCs, UK Addendum and Swiss terms in Cloudflare's DPA. |
| Discord, Inc. | Internal alert channel for our operations team. | Operational alerts that contain only masked or pseudonymised customer data: event type, service, order and ticket references, masked email addresses and truncated IP addresses. No backup, server or website contents. | United States | EU-US Data Privacy Framework, UK Extension and Swiss-US Data Privacy Framework. |
| Openprovider (Hosting Concepts B.V.) | Registration, renewal, transfer, WHOIS privacy and DNS for domains you buy from us. | Registrant name, postal address, email and phone number, domain names and DNS records. | Netherlands | Established in the EU, so data from the EEA is not a restricted transfer. Openprovider's data processing agreement. |
| Stripe, Inc. | Card payments, saved cards for renewals, and refunds. | Email address, customer and order identifiers, the card and billing details you enter in Stripe's form, and device data for fraud checks. | United States | EU-US Data Privacy Framework and its UK and Swiss extensions. EU SCCs and UK Addendum in Stripe's DPA. Stripe is also an independent controller for fraud prevention and legal compliance. |
| Telnyx LLC (from November 30, 2026) | Phone verification codes and opt-in text messages, alongside VoIP.ms, only if you add a US or Canadian mobile number. | Phone number and message text. | United States | EU-US Data Privacy Framework, UK Extension and Swiss-US Data Privacy Framework. EU SCCs and UK Addendum in Telnyx's DPA. |
| VoIP.ms | Phone verification codes and opt-in text messages, only if you add a US or Canadian mobile number. | Phone number and message text. | Canada | EU adequacy decision for Canada. |
#3. Independent recipients
These organizations receive personal data to do their own job, under their own terms. They decide how they use it, so they are not our sub-processors. We list them so the picture is complete.
- PayPal: if you pay with PayPal. PayPal is an independent controller of payment data and protects transfers with binding corporate rules and standard contractual clauses.
- Domain registries and ICANN: receive registration data for domains you buy from us, as each registry's rules require.
- Let's Encrypt: issues the TLS certificates for websites we host. Certificate requests include the domain name, which is published in public Certificate Transparency logs.
- Banks: if you pay by bank transfer, your bank and ours process the payment details.
- The Bitcoin network: if you pay with Bitcoin, the transaction is public on the blockchain. Our BTCPay Server is self-hosted, so your invoice details stay with us.
#4. What we run ourselves
These run on hardware we own and operate in Los Angeles, not on third-party clouds: backup vaults, ServerCrate Backup, Proxmox Backup Server datastores, Borg repositories, cloud servers, web hosting, the customer portal and its database, email (sending and receiving), BTCPay Server, website analytics (Umami), the status page, push notification signing, and our security monitoring.
#5. What is not listed, and why
- Network carriers: the internet providers that carry traffic to and from our network are conduits. They transmit traffic, most of it encrypted, and do not process data for us. The same applies to the mail servers that receive email we send.
- Browser push services: if you turn on notifications, your browser's vendor relays them. Every notification is encrypted on our servers for your device before it leaves, so the relay sees only ciphertext.
- Services that hold no customer data: an external watchdog server that checks our public services and runs a backup-and-restore test against our own test vault, and secondary DNS for our own domains.
#6. Change notices and objections
At least 30 days before a new sub-processor starts receiving personal data, we:
- add it to this page with the date it takes effect;
- publish the change in this page's Atom feed, which any feed reader can follow;
- email the address on every account with an active paid service.
If you object on reasonable data protection grounds, email privacy@servercrate.net within those 30 days. We will try to find an alternative with you. If we cannot, you may terminate the affected service and we refund prepaid fees for the time after termination, as section 7 of the Data Processing Agreement sets out. If we must replace a sub-processor urgently for security or continuity, we tell you as soon as we can and the same objection right applies.
Removing a sub-processor needs no advance notice. We record it in the changelog below.
#Changelog
- October 30, 2026 - Notice: Telnyx LLC will deliver text messages alongside VoIP.ms, starting November 30, 2026. It receives only phone numbers and message text, for customers who add a mobile number. Object by November 29, 2026 at privacy@servercrate.net.
- October 30, 2026 - Narrowed Cloudflare's scope. Portal icon files now come from our own servers, and the Turnstile bot check loads only when someone starts filling in the sign-up form.
- October 29, 2026 - First published as its own page. Added Cloudflare (sign-up bot check and portal icon files) and Discord (internal alerts), which earlier summaries did not list. Moved PayPal to independent recipients, because PayPal acts as an independent controller.