Subprocessors
The companies that process data on our behalf, what each one does, and where it sits.
Where we process personal data on your behalf, these are the parties we use to do it. Each is bound by a contract that holds them to the same obligations we owe you.
| Company | What it does | Data it sees | Location |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Servers, storage and the database. The application runs here. | Everything, at rest and in transit | European Union (Ireland) |
| Stripe, Inc. / Stripe Payments Europe | Card payments, subscriptions and invoicing. | Name, email, billing address, card details (we never see the card) | Ireland (EU) / United States |
| CryptoPayr | Cryptocurrency payments for prepaid packs. | Payment amount, wallet transaction, our internal reference | EU |
| Mailgun Technologies, Inc. | Transactional email: verification, password reset, receipts, expiry notices. | Email address and message content | United States |
| Cloudflare, Inc. | DNS, TLS termination and protection against denial-of-service attacks. Also Turnstile, which checks that the person filling in the sign-in, registration and password-reset forms is a person. | Connection metadata and IP addresses in transit. For Turnstile, the IP address and browser characteristics of anyone using those three forms. | Global edge network |
Data feed providers are not subprocessors
AbuseScore ingests published data from network operators and public security projects, and public blocklists. Those are one-way: we download what they publish. No customer data, no account data and no query data is ever sent to any of them. They appear under Data Sources & Attribution instead, because that is what they are.
International transfers
Where a processor is outside the EEA, transfers rely on Standard Contractual Clauses or an equivalent safeguard, together with encryption in transit and at rest.
Changes
We will update this page before a new subprocessor starts handling personal data. If you want to be told when it changes, email [email protected] and we will add you to the notification list. Customers with a signed data processing agreement are notified as a matter of course and may object to a new subprocessor.
Everything above is the complete list. If you need a signed data processing agreement, a copy of the transfer safeguards, or notice of changes before they happen, write to [email protected] and we will send them.