Sub-Processors
Last updated: September 2026
Annex 2 to the Data Processing Agreement — List of authorized sub-processors pursuant to Art. 28 GDPR
Overview
Hoppla uses the following sub-processors to provide the monitoring service. All sub-processors are bound by Data Processing Agreements (DPAs) and process data only as instructed by Hoppla for the stated purpose.
We keep this list to a minimum and regularly evaluate whether each sub-processor is still required.
Current Sub-Processors
| Sub-Processor | Purpose | Data Processed | Location | Transfer Safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting (application servers, databases, block storage) | All application data (encrypted at rest) | EU (Germany, Finland) | EU processing — no transfer |
| Cloudflare, Inc. | DNS, DDoS protection, CDN, WAF and TLS termination. Cloudflare terminates TLS in front of every hoppla.dev hostname and therefore processes request and response content in transit, including session cookies and API tokens. Public marketing pages are cached at the edge. Also provides the Turnstile anti-abuse widget on our form pages. | All request and response content in transit, client IP addresses, approximate country | Global anycast network; requests are served from the nearest point of presence, which may be outside the EEA | EU SCCs, Data Processing Addendum |
| Mailgun (Sinch Email US, Inc.) | Transactional email delivery (notifications, account emails) | Recipient email addresses, notification subject and body content | EU (processing in EU region configured) | EU SCCs, DPA in place |
| Paddle.com Market Ltd | Payment processing, subscription billing, invoicing (paid plans; billing pre-launch) | Customer name, email, billing address, VAT ID, payment method identifiers, invoice history | UK / EU | UK adequacy decision, DPA in place |
| Let's Encrypt (ISRG) | TLS/SSL certificate issuance | Domain names of monitored assets and customer custom domains. These are additionally published in public Certificate Transparency logs, as the CA/Browser Forum requires. | USA (public certificate authority) | No personal data processed |
| OpenRouter, Inc. | AI features, available on Starter and above: incident analysis, invoked only when a user requests an analysis; and the AI-written summary of the monthly PDF report, only for a team that has switched it on, including in that team's automatic monthly report | Incident analysis: monitor name, the monitored hostname and path, names of other monitors in the same account, tags, the most recent incident update text and error-log signatures. Report summary: team name, monitor and scheduled-job names, monitored hostnames (no paths), the report's figures (availability, downtime, response times, certificate and domain expiry, quality scores), and incident titles and durations. Both: a pseudonymous tenant identifier | USA | SCCs. OpenRouter routes the request to a model provider, which acts as a further sub-processor. |
| Google Ireland Ltd / Google LLC | Chrome UX Report API — supplies real-user Core Web Vitals for the performance check type. Google Fonts additionally serves a web font on a public status page where that page's operator has selected one. | The monitored origin URL. For status-page fonts: the visitor's IP address, user agent and referrer. | USA | EU SCCs (Implementing Decision (EU) 2021/914) |
| Apple Distribution International Ltd / Apple Inc. | Apple Push Notification service — delivers alerts to the iOS app | Device push token and the notification payload (monitor name, incident status) | USA | EU SCCs (Implementing Decision (EU) 2021/914) |
Self-hosted (not third-party sub-processors): application error tracking runs on a self-hosted GlitchTip instance within our own Hetzner infrastructure, so telemetry is not shared with any third party. OpenRouter is engaged only when a user asks for an AI incident analysis, or for a team that has switched on the AI summary of its monthly report; for such a team it is also called by the automatic monthly report. It is not called for any other team or on any other automatic path.
Data Flow Summary
- Hetzner: Primary data processor. All application data, databases (PostgreSQL, Redis), and backups are stored on Hetzner infrastructure within the EU. Data is encrypted at rest (AES-256) and in transit (TLS 1.3).
- Cloudflare: Acts as a reverse proxy. Processes domain names and IP addresses in transit for DNS resolution, DDoS mitigation, and TLS termination. Does not persistently store personal data. EU traffic is routed through EU data centers where possible.
- Mailgun: Receives email addresses and notification content for delivery. Email delivery logs are retained by Mailgun per their retention policy. Mailgun is configured to process data in the EU region. We do not share any monitoring data, check results, or account credentials with Mailgun.
- Paddle: Processes billing and payment data as our Merchant of Record. Paddle receives customer name, email address, and billing address for invoice generation and payment processing. We do not store full credit card numbers or payment credentials — these are handled exclusively by Paddle.
Changes to Sub-Processors
Notification
We will notify customers at least 30 days in advance before:
- Adding a new sub-processor
- Replacing an existing sub-processor with a different provider
- Materially changing the scope of data processed by an existing sub-processor
Notifications will be sent via email to the team owner / account administrator. This page will also be updated accordingly.
Objection Right
If you object to a new or changed sub-processor, you may raise your objection in writing within the 30-day notice period. We will work with you in good faith to address your concerns. If no mutually acceptable resolution can be reached, you may terminate your account in accordance with the Terms of Service.
Sub-Processor Due Diligence
Before engaging any sub-processor, Hoppla evaluates:
- The sub-processor's data protection and security certifications (ISO 27001, SOC 2, etc.)
- Their Data Processing Agreement and compliance with GDPR Art. 28
- Data location and transfer mechanisms (adequacy decisions, SCCs)
- Technical and organizational security measures
- Track record regarding data breaches and incident response
Contact
For questions about our sub-processors or to report a concern:
Email: [email protected]