Sub-processors
Every company we use to run Vitrina Engine, what they do, where they process, and what makes sending data to them lawful. This is the whole list — there is no second one, and no category of “infrastructure providers” standing in for names.
Where a safeguard is missing, this page says so rather than leaving the column blank. See the privacy policy for what each kind of data is and how long we keep it.
| Who | What they do | Where | What data | Transfer basis |
|---|---|---|---|---|
| Paddle.com Market Ltd | Payments, invoicing and sales tax, as merchant of record. | United Kingdom | Billing contact details and subscription state. No monitoring data. | Standard contractual clauses. |
| Scaleway SAS | Sending transactional and alert email. | France | Recipient addresses and the content of the emails we send you, including alert text. Status page subscriber addresses. | Processed in the European Union — no third-country transfer. Article 28 DPA. |
| Lettermint B.V. | Sending marketing email — the newsletter and the opt-in onboarding sequence. | European Union | Email addresses that opted in to marketing, and the content of those messages. No account, monitoring or billing data. | Processed in the European Union — no third-country transfer. Article 28 DPA. |
| Cloudflare | DNS, TLS termination, protection against attack, and cookieless page-view counting. | United States, with edge servers worldwide | Every request to this site passes through them, including IP addresses. | Standard contractual clauses. |
| Website analytics on the public site only, and only for visitors who allowed it. Never the dashboard, never a status page. | United States | Public website usage. Nothing from your account or your monitoring. | Google's data processing terms. | |
| Backblaze | Off-site storage of nightly encrypted database backups. | EU Central (Amsterdam) | A nightly encrypted dump of the whole database, kept 90 days. Unreadable without a key held outside this system. | Encrypted before upload to a key Backblaze does not hold; stored in the EU. |
| Contabo GmbH | The servers that run the product and hold the database. | European Union | All account, configuration and monitoring data. | Processed in the European Union — no third-country transfer. Article 28 DPA. |
| Markahost Telekomunikasyon ve Ticaret Limited Şirketi | A server running a monitoring probe. | Istanbul, Turkey | The targets of checks it runs and their results. No account data — a probe is never given a database credential — and no check whose configuration could carry personal data. | Standard contractual clauses. |
Changes
This page is the record. When we add or replace a sub-processor we update it here, and the date below changes with the list rather than with the next edit to the page. If you need to hear about a change before it happens — some contracts require it — write to privacy@vitrinaengine.com and we will add you to the list of people we tell.
Sub-processor list last changed 5 September 2026.
Data you control
Two of these see data that belongs to your customers rather than to you. Scaleway sends the confirmation and update emails for any status page you publish, so it processes the addresses of your subscribers; you are the controller for those and we process them on your behalf. Cloudflare sits in front of your status pages, so it sees the IP addresses of people reading them. Neither is optional while those features are in use.
Last updated 31 August 2026.