Sub-processors
Last updated Mon Nov 09 2026 00:00:00 GMT+0000 (Coordinated Universal Time)
Media (images, GIFs, videos) is processed only by the first two entries, in memory and in transit. All other providers handle account, billing, usage, website or support data and never see media. Changes are announced here and by email to account holders at least 30 days before they take effect.
| Provider | Location | Purpose | Data | Safeguard |
|---|---|---|---|---|
| 24fire GmbH | Germany | hosting of the API, inference workers and database | media in memory during a request; account and usage data | EU |
| Cloudflare, Inc. | EU edge, US company | DNS, TLS termination, DDoS protection and bot management for api.sfwapi.dev; email routing for @sfwapi.dev | media in transit; incoming support email | EU–US Data Privacy Framework, SCCs |
| Stripe Payments Europe, Ltd. | Ireland, with Stripe, Inc. in the US | payments, invoices, tax calculation | billing data | EU–US Data Privacy Framework, SCCs |
| PostHog, Inc. (EU Cloud) | Germany | website analytics after consent; support ticket inbox | pseudonymous usage data; support emails | EU hosting; SCCs for the US parent |
| Mailgun Technologies, Inc. (via PostHog) | EU region | receiving and sending support email for the PostHog inbox | support emails | SCCs |
| Resend, Inc. | United States, EU sending region | transactional email: sign-in links, receipts, balance notices | email address, subject, message | SCCs |
| Vercel Inc. | United States, served from EU edge | hosting of the website sfwapi.dev only | website request logs; no account data, no media | EU–US Data Privacy Framework, SCCs |
| Backblaze, Inc. (B2, EU region) | Netherlands | encrypted off-site backups of the non-content database | encrypted account and usage data | EU hosting; SCCs for the US parent |
Independent controllers that are not sub-processors: GitHub, Inc. and Google LLC when you choose them as sign-in providers.