Sub-processors
Every party that processes data on our behalf.
At a glance
A deliberately short list — encrypted storage, network and edge security, compute, business email, and transactional email, with two providers engaged for continuity. Every backup is encrypted before it reaches any of them, and each provider is engaged under data-processing terms (a DPA, with the EU Standard Contractual Clauses where required for international transfers) after a security and privacy review.
| Provider | Purpose | Your backup content | Location |
|---|---|---|---|
| Cloudflare R2 | Encrypted backup storage | Ciphertext only — the encryption key is never shared | United States or European Union — your choice |
| Cloudflare Network | DNS and bot-check challenges | Never — account and traffic metadata only | Global edge |
| Google Workspace | Business email — inbound support, privacy, and security correspondence | Never — email correspondence only | United States |
| Hetzner | Compute and hosting for the Services | Transient, in-memory only during a run — keys never persisted | United States |
| Scaleway | Transactional email (account and security notifications) | Never — your email address and notification content only | European Union (France) |
| SMTP2GO | Transactional email (account and security notifications) | Never — your email address and notification content only | United States / European Union (New Zealand company) |
Hetzner provides the compute for the Services from its United States region, colocated in an ISO/IEC 27001:2022-certified data-center facility operated by NTT Global Data Centers Americas. Backups are transient and encrypted — never stored on this compute layer. Last updated: September 28, 2026.
Change log
- September 28, 2026 — corrected the purpose listed for Cloudflare Network to DNS and bot-check challenges: none of our traffic passes through its CDN or edge security.
- August 20, 2026 — removed MailPace (it no longer processes any data for the Services) and added Scaleway as the second transactional-email provider, for continuity of account and security notifications.
- August 18, 2026 — added SMTP2GO as a second transactional-email provider, for continuity of account and security notifications.
- July 15, 2026 — noted the ISO 27001-certified US data-center facility (NTT Global Data Centers) behind the Hetzner compute.
- July 8, 2026 — initial sub-processor list published.
What you won’t find here
- Advertising networks
- Analytics vendors that receive your customer data
- AI providers that process your content
- Data brokers
The services you connect to back up — such as Airtable — are your own third parties, not our sub-processors. We read from them only on your instruction, to produce your backups. Because every backup is encrypted before storage, storage providers only ever hold ciphertext.
Questions about this list, or want to receive change notices? Email privacy@alreadyback.com.