Sub-processors
Last updated: 3 November 2026
This page lists the third parties that process data on behalf of Vault42. Vault42 is pre-launch: the first table covers the waitlist site as it runs today, the second covers the launch service as we currently plan it. We keep this page up to date, and we publish changes here before they take effect.
The waitlist site, today
| Third party | Role | Location | Transfer safeguard | What they process |
|---|---|---|---|---|
| Scaleway S.A.S. | Hosting and email | France (EU regions only) | None needed: EU provider, EU regions | Hosts this website, the waitlist database and the Matrix server, runs our DNS and domain registration, and sends the transactional email that confirms signups. |
| Hetzner Online GmbH | Backup storage | Germany (EU) | None needed: EU provider, EU regions | Holds the off-site backups of this website and the waitlist database. Backups are encrypted with restic before they leave our servers. Hetzner stores them but never has the key, so it cannot read them. |
| Proton AG | Email (shared mailboxes) | Switzerland | EU adequacy decision (Switzerland) | Hosts the shared mailboxes, so it processes the messages people send to Vault42. Mail is stored encrypted on Proton’s servers. |
| Keila GmbH | Marketing email | Germany (EU infrastructure in Germany and France) | None needed: EU provider, EU regions | Keila Cloud stores the addresses of newsletter subscribers and sends the newsletter. Before launch, it may also receive a copy of the waitlist addresses to send waitlist updates. |
Web analytics run on Matomo, self-hosted on Vault42 infrastructure in the EU. No third-party analytics provider receives your data.
The launch service, as planned
| Third party | Role | Location | Transfer safeguard | What they process |
|---|---|---|---|---|
| Scaleway S.A.S. | Hosting, object storage, email | France (EU regions: Paris, Amsterdam, Warsaw, Milan) | None needed: EU provider, EU regions | Hosts the service: servers, LFS and object storage, daily snapshots, and transactional email. Also hosts the Matrix server, and runs our DNS and domain registration. |
| Hetzner Online GmbH | Backup storage | Germany (EU) | None needed: EU provider, EU regions | Holds the second-region copy of every backup, including repository data. Backups are encrypted with restic before they leave our servers. Hetzner stores them but never has the key, so it cannot read them. |
| Proton AG | Email (shared mailboxes) | Switzerland | EU adequacy decision (Switzerland) | Hosts the shared mailboxes, so it processes the messages people send to Vault42. Mail is stored encrypted on Proton’s servers. |
| Mollie | Payment processing | Netherlands | To be confirmed before launch | Processes payments. Mollie’s merchant dashboard is hosted on Google Cloud, a US provider. Card payments are routed through the Visa and Mastercard networks (US companies) as part of that processing. These parties see payment data, never your repositories. |
| Meteroid | Subscription billing | France (cloud on Hetzner, Germany) | To be confirmed before launch | The billing system we plan to use for subscriptions and invoicing. Meteroid is a French company with no subsidiaries, fully owned by its team and individual shareholders, all EU citizens. It processes billing data, never your repositories. |
| Keila GmbH | Marketing email | Germany (EU infrastructure in Germany and France) | None needed: EU provider, EU regions | Keila Cloud stores the addresses of newsletter subscribers and sends the newsletter. Before launch, it may also receive a copy of the waitlist addresses to send waitlist updates. |
Mollie's dashboard runs on Google Cloud, a US provider. Every US-linked provider on this page runs on EU data centres, and before launch we will publish the transfer safeguard covering each, such as standard contractual clauses or the EU-US Data Privacy Framework.
Where your repositories live
Repository contents live on Vault42's EU infrastructure: Scaleway hosts them, and Hetzner holds the encrypted backup copy. Every other party on this page handles payment or billing data and nothing else. We name the US-linked providers in those layers plainly, because a careful buyer should not have to dig for them.
Changes
Before a new sub-processor gains access to customer data, we will list it here first, and notify affected customers directly if the change affects them. If a provider on this list matters to your procurement review and you need more detail, email privacy@vault42.eu.