Last updated: 13 May 2026
Sub-processors are third-party services that process personal data on behalf of Nodebrush. Under Article 28 of the GDPR, we publish this list so our clients and visitors can see who has access to data we handle on their behalf, and when that changes.
Some sub-processors below are headquartered outside the European Economic Area, typically the United States. Under EU data protection law (Schrems II), this is classified as an international transfer regardless of where the data physically sits. Transfers to these sub-processors are covered by Standard Contractual Clauses (SCCs) included in each sub-processor's Data Processing Addendum, the legal mechanism the European Commission has approved for this purpose. The practical exposure varies by sub-processor; each entry below describes what kind of data that provider receives.
Current sub-processors
- Vercel Inc., a US company. Runs the application backend; every request, login, content save, and form submission passes through Vercel's compute layer. Persistent data is stored on Hetzner, not Vercel. Transfers covered by SCCs in the Data Processing Addendum.
- Hetzner Online GmbH, a German company. Persistent storage for the database, file uploads, and server-side state in EEA. No international transfer. Data Processing Agreement available.
- Twilio Inc. (SendGrid), a US company. Delivers transactional email; receives sender, recipient, subject, and message body in transit and retains delivery metadata. Body content is not persistently stored. Transfers covered by SCCs in the Data Processing Addendum.
- Google LLC, a US company. reCAPTCHA receives visitor IP and device or browser signals to detect bots; the contact form's contents are not sent to reCAPTCHA. Google Maps receives the visitor's IP when a page with a map is loaded. Transfers covered by SCCs in the Data Processing Addendum.
Fully EU-hosted setup
If you need a fully EU-hosted setup with no transfers to third countries, we can replace the US sub-processors with EU equivalents and move the application backend to Hetzner. This is available as a custom scope; contact us to discuss the options.
Changes to this list
When a sub-processor is added, removed, or changed, this page is updated and the date above is bumped. Clients with a signed agreement are responsible for monitoring this page; the agreement defines the objection procedure if you do not consent to a change.