Sub-processors
Every company we use to run Vitrina Engine, what they do, where they process, and what makes sending data to them lawful. This is the whole list — there is no second one, and no category of “infrastructure providers” standing in for names.
Where a safeguard is missing, this page says so rather than leaving the column blank. See the privacy policy for what each kind of data is and how long we keep it.
Scaleway SAS
- What they do
- Sending transactional and alert email, and off-site storage of nightly encrypted database backups.
- Where
- France and the Netherlands
- What data
- Recipient addresses and the content of the emails we send you, including alert text. Status page subscriber addresses. Separately, a nightly encrypted dump of the whole database, kept 90 days and unreadable without a key held outside this system.
- Transfer basis
- Processed in the European Union — no third-country transfer. Article 28 DPA. Backups are encrypted before upload, to a key Scaleway does not hold.
ONLINECITY.IO ApS (GatewayAPI)Buchwaldsgade 50, 5000 Odense C, DenmarkOnly if somebody enrols a mobile number for SMS alerts.
- What they do
- Sending SMS alerts and the code that confirms a mobile number.
- Where
- European Union
- What data
- The mobile number of each person who enrolled one, and the text of the alerts sent to it — which names the monitor and its state. Only for people who enrol a number, on plans that include SMS.
- Transfer basis
- Processed in the European Union — no third-country transfer. Article 28 DPA.
Meta Platforms Ireland LimitedOnly if somebody enrols a number for WhatsApp alerts.
- What they do
- Delivering WhatsApp alerts and the code that confirms a WhatsApp number.
- Where
- Ireland, with onward transfer to the United States
- What data
- The WhatsApp number of each person who enrolled one, and the two values that fill the message template — the monitor or website name, and its state. Only for people who enrol a number.
- Transfer basis
- Standard Contractual Clauses and the EU-US Data Privacy Framework, under Meta's WhatsApp Business Solution Terms.
Lettermint B.V.Only if somebody subscribes to the newsletter.
- What they do
- Sending marketing email — the newsletter and the opt-in onboarding sequence.
- Where
- European Union
- What data
- Email addresses that opted in to marketing, and the content of those messages. No account, monitoring or billing data.
- Transfer basis
- Processed in the European Union — no third-country transfer. Article 28 DPA.
BunnyWay, informacijske storitve d.o.o.
- What they do
- The content delivery network in front of this site: DNS, TLS termination and caching.
- Where
- Slovenia, with edge servers worldwide
- What data
- Every request to this site passes through them, including IP addresses.
- Transfer basis
- Signed data processing agreement with standard contractual clauses. IP addresses are anonymised in their logs.
Google Cloud EMEA Limited70 Sir John Rogerson's Quay, Dublin 2, IrelandOnly if somebody installs the mobile app and allows notifications.
- What they do
- Delivering push notifications to devices, through Firebase Cloud Messaging.
- Where
- Ireland, with onward transfer to the United States
- What data
- The device token of each device somebody registered for push alerts, and the text of the alerts sent to it — which names the monitor and what went wrong. Only for people who use push.
- Transfer basis
- Contracted with Google Cloud EMEA Limited in Ireland. Their onward transfer to Google LLC in the United States runs on the processor-to-processor standard contractual clauses Google publish for Firebase.
Microsoft Ireland Operations Limited
- What they do
- Our business email — the mailboxes behind our own addresses.
- Where
- United States
- What data
- Email you send us and our replies — support, billing and security correspondence, and whatever those messages contain. No access to your account, your monitoring data or the database.
- Transfer basis
- Standard Contractual Clauses, through the Data Protection Addendum to the Microsoft Online Services Terms. Exchange Online is in scope.
Contabo GmbH
- What they do
- The servers that run the product and hold the database.
- Where
- European Union
- What data
- All account, configuration and monitoring data.
- Transfer basis
- Processed in the European Union — no third-country transfer. Article 28 DPA.
Changes
This page is the record. When we add or replace a sub-processor we update it here, and the date below changes with the list rather than with the next edit to the page. If you need to hear about a change before it happens — some contracts require it — write to privacy@vitrinaengine.com and we will add you to the list of people we tell.
Sub-processor list last changed 9 September 2026.
Data you control
Two of these see data that belongs to your customers rather than to you. Scaleway sends the confirmation and update emails for any status page you publish, so it processes the addresses of your subscribers; you are the controller for those and we process them on your behalf. Bunny sits in front of your status pages, so it sees the IP addresses of people reading them. Neither is optional while those features are in use.
Last updated 31 August 2026.