Sub-processors

Every party that processes data on our behalf.

The third parties that help us run the Services, what each one does, whether it ever sees your backups, and where. We email affected customers at least 30 days before adding or replacing any of them — no subscription required — as set out in our DPA.

At a glance

Four sub-processor services across three companies — encrypted storage, network, compute, and transactional email. Every backup is encrypted before it reaches any of them, and each provider is engaged under data-processing terms (a DPA, with the EU Standard Contractual Clauses where required for international transfers) after a security and privacy review.

Provider	Purpose	Your backup content	Location
Cloudflare R2	Encrypted backup storage	Ciphertext only — the encryption key is never shared	United States or European Union — your choice
Cloudflare Network	DNS, CDN, and edge security	Never — account and traffic metadata only	Global edge
Google Workspace	Business email — inbound support, privacy, and security correspondence	Never — email correspondence only	United States
Hetzner	Compute and hosting for the Services	Transient, in-memory only during a run — keys never persisted	United States
MailPace	Transactional email (account and security notifications)	Never — your email address and notification content only	United Kingdom / European Union

Hetzner provides the compute for the Services from its United States region, colocated in an ISO/IEC 27001:2022-certified data-center facility operated by NTT Global Data Centers Americas. Backups are transient and encrypted — never stored on this compute layer. Last updated: July 15, 2026.

Change log

July 15, 2026 — noted the ISO 27001-certified US data-center facility (NTT Global Data Centers) behind the Hetzner compute.
July 8, 2026 — initial sub-processor list published.

What you won’t find here

Advertising networks
Analytics vendors that receive your customer data
AI providers that process your content
Data brokers

The services you connect to back up — such as Airtable — are your own third parties, not our sub-processors. We read from them only on your instruction, to produce your backups. Because every backup is encrypted before storage, storage providers only ever hold ciphertext.

Questions about this list, or want to receive change notices? Email privacy@alreadyback.com.