Subprocessors
Every third party that can touch data on our behalf, and what it does.
Version 1.0 In force since September 2, 2026 Updated September 2, 2026
We keep the list short on purpose: each name here is one more party with access, and the cheapest way to protect data is not to hand it over. Each is bound by a written contract with obligations no weaker than those in our Data Processing Addendum.
| Subprocessor | What it does | Location | Data it can reach |
|---|---|---|---|
| Hetzner Online GmbH | Runs the application, the database, the cache and the backups | Germany (Falkenstein and Nuremberg) | All tenant data at rest |
| Quathos Mailer (Quathos LLC) | Delivers every transactional email: verification links, password resets, invitations, second-factor and security notices | United States; infrastructure in Germany (Falkenstein and Nuremberg) | Recipient name and email, message content, delivery events |
| Stripe, Inc. | Checkout, subscriptions and invoices for the product itself | United States and Ireland | Billing contact, payment details you give directly to Stripe, subscription and invoice records. Card numbers never reach us |
| Cloudflare, Inc. | Authoritative DNS for the quathos.com zone and issuance of the wildcard TLS certificates for auth.quathos.com (ACME DNS-01). It does not proxy or inspect traffic | United States | Hostnames and DNS records — including the subdomain of your tenant. No end-user personal data |
| Twilio Inc. — SMS provider | Delivers one-time codes by SMS. Only when you enable SMS OTP for your tenant; otherwise it receives nothing | United States | Phone number, the code sent, delivery events |
Parties you connect yourself are not subprocessors of ours: the applications you register (which receive the claims your users authorise), the webhooks you configure, the social or enterprise identity providers you federate with, and the SAML or OIDC connections you set up. Each of those is your instruction to send data somewhere you chose, and what happens on the other end is governed by your agreement with that party. We hold the credentials you give us for them encrypted, and use them only for the connection you asked for.
Notice of changes
We announce a new or replacement subprocessor at least 30 days before it starts processing, by email to tenant administrators and by updating this page. Your right to object is set out in the Data Processing Addendum. To be notified, write to privacy@quathos.com.