Sub-processors
Every vendor. Named, scoped, dated.
A sub-processor is any third party that processes data on our behalf. We list ours here, what we send them, where they sit, and the GDPR transfer basis under which they receive any personal data.
Active sub-processors
Current roster (2026-05-20).
| Sub-processor | Purpose | Data categories | Jurisdiction | Transfer basis |
|---|---|---|---|---|
| Cloudflare, Inc. cloudflare.com |
Edge delivery, DNS, WAF, DDoS protection, R2 object storage, Pages hosting. | HTTP request metadata, IP, user-agent. No application content at rest. | US (global edges) | SCC + UK Addendum |
| Lemon Squeezy lemonsqueezy.com |
Merchant of Record. Handles checkout, payment processing, tax remittance, invoicing. | Buyer name, email, billing address, card brand & last 4. Card numbers never reach Aevrix. | US (Stripe sub-processor) | SCC + UK Addendum |
| Google Workspace google.com |
Corporate email, calendars, documents, internal collaboration. Includes @aevrix.dev / @aevrix.org / @aevrix.group mailboxes. | Email content, contact metadata, calendar entries. | US / EU (data regions per Workspace settings) | SCC + UK Addendum + Data Privacy Framework |
| GitHub (a Microsoft company) github.com |
Source code hosting, CI, package registry for public Aevrix repositories. | Commit metadata, public source. No production data. | US | SCC + UK Addendum |
| Contabo GmbH contabo.com |
Dedicated server hosting for backend services (Axion stack). | Application data at rest. Encrypted at the volume level. | Germany (EU) | EU intra-territorial |
| Backblaze B2 backblaze.com |
Off-site encrypted backups (Restic). Snapshots never leave us in plaintext. | Encrypted backup blobs only — keys held by Aevrix. | US (EU region available) | SCC + UK Addendum |
Notifications
Material changes.
We update this page whenever a sub-processor is added, removed, or replaced. Enterprise customers under a signed DPA can request advance notification of new sub-processors via trust@aevrix.group.
What's not here
Tools that don't process data on our behalf.
Tools we use internally but that do not process customer data on our behalf — for example, password managers, productivity software, accounting software — are not listed here. If you need a complete vendor inventory under audit, write to trust@aevrix.group.
DPA enquiry?
Enterprise DPA, signed sub-processor pre-notification, and security questionnaires.