Subprocessors (Annex 2 to the DPA)
We use the following subprocessors. The list is part of the Data Processing Agreement (DPA).
| Subprocessor | Purpose | Location | Transfer basis | Active? |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting and object storage | DE (Falkenstein/Nuremberg) | EU — DPA Art. 28 | yes |
| Resend | Email (transactional) | EU region Frankfurt (US parent) | EU processing; US parent no routine access; support access via SCC | yes |
| Sentry | Error tracking (Visz-internal errors only) | EU Frankfurt | EU — DPA | yes |
| Grafana Cloud | Metrics and logs | EU region | DPA to be obtained before beta; SCC (US parent) | yes |
| Better Stack | Status page and SLA probe | EU region | DPA to be obtained before beta; SCC (US parent) | yes |
| Zoho Mail | Support inbox info@visz.ai | EU region (Amsterdam) | DPA to be obtained before beta; SCC | yes |
| Cloudflare | CDN (visz.ai marketing site only) | global | DPF adequacy and SCC | yes |
| GitHub Actions | CI/CD | US | SCC — NEVER production/customer data | yes |
| MaxMind GeoLite2 | Geo lookup | local on own server | NOT a subprocessor (no external call) | documented |
Note: MaxMind GeoLite2 runs as a local database without any external call and is therefore not a subprocessor within the meaning of Art. 28. rrweb runs in the visitor's browser and is also not a subprocessor (code in the snippet, not a service provider).
Optional / conditional subprocessors
These are only listed when actually enabled:
- Cloudflare R2 — optional object-storage backup (EU; DPA/SCC).
- Vercel — optional marketing deploy (US; SCC; not a processor if marketing site only).
- Slack — only if the customer connects an integration (US; the customer picks the channel and is responsible).
- Postmark — optional mail backup (EU; Resend is primary).
Update process
New or changed subprocessors are announced to active customers with 30 days' prior notice. The controller has a right to object (DPA § 6). The list is versioned.