Who else touches your data
A sub-processor is a company we use to run Yellow Duck that may process your data. This is the full list. We give 30 days' notice before adding one, and you can object under the DPA.
| Sub-processor | What for | Where | What data | Safeguards |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting of the service, app containers, database, object storage and backups | Falkenstein, Germany · Helsinki, Finland | App source code, app data, account data, audit log, backups | EU-owned. Data processing agreement with Hetzner. ISO 27001-certified data centres. |
| Scaleway SAS | Transactional email: invitations and service notices | Paris, France | Recipient name and email address, the email itself | EU-owned. Data processing agreement with Scaleway. |
| Anthropic, PBC | Plain-language summary of check results | United States | Structured findings only: tool, rule, severity, file path. No source code, no personal data. | Data processing addendum with EU Standard Contractual Clauses. API data is not used for training. Can be switched off per organisation in Settings. |
Not on this list, on purpose
GitHub. You connect your own GitHub account and choose which repositories we may read. That runs under your contract with GitHub and GitHub's own permissions, so GitHub is not our sub-processor.
Microsoft and Google. Your identity provider is yours. We receive a login token from it; we don't send it your data.
Analytics and error tracking. None today. If we add a vendor, it appears here 30 days before we start using it.
Get notified of changes
Administrators of every organisation are emailed 30 days before a change. Anyone else can write to privacy@ with the subject “Sub-processor notice”.
17 Sep 2026 — first version: Hetzner, Scaleway, Anthropic.