Subprocessors
Last updated: 13 June 2026
NordenVault uses a limited number of third-party service providers (subprocessors) to help deliver the Service. This page lists all subprocessors that process personal data or customer data on our behalf, in accordance with GDPR Article 28.
We will update this page when subprocessors are added, removed, or changed. Customers with a Data Processing Agreement in place will receive advance notice of any changes and may object within the timeframe specified in the DPA.
Current subprocessors
| Provider | Purpose | Country | Data processed | Jurisdiction |
|---|---|---|---|---|
| Hetzner Online GmbH | Object storage, compute infrastructure | Germany | Customer backup data (encrypted at rest), API processing | EU |
| UpCloud Oy | Managed database hosting | Finland | Application database (accounts, credentials, usage, audit logs) | EU |
| WorkOS Inc. | Authentication and identity management | United States | Email address, login metadata, session tokens | US (SCCs in place) |
| Resend Inc. | Transactional email delivery | United States | Email address, notification content | US (SCCs in place) |
| Stripe Inc. | Payment processing and billing | United States | Billing information, payment method, customer identity | US (independent controller) |
| Vercel Inc. | Frontend hosting and CDN | United States | IP address, request metadata (no customer backup data) | US (SCCs in place) |
Customer backup data
Customer backup data is stored exclusively on EU infrastructure (Hetzner Online GmbH, Germany). No other subprocessor has access to the contents of customer backup data. When client-side encryption is used (e.g., via restic), backup data is encrypted before it reaches our infrastructure, and we have no ability to read it.
Standard Contractual Clauses
Where a subprocessor is based outside the EEA, we rely on EU Standard Contractual Clauses (SCCs) as the legal mechanism for data transfers, in accordance with GDPR Chapter V. Stripe operates as an independent data controller for payment data under its own privacy policy.
Questions
If you have questions about our subprocessors or would like to receive notifications of changes, contact us at contact@nordenvault.com.