Overview
A sub-processor is a third party engaged by kwery (acting as Processor) that processes personal data on behalf of our Customers (acting as Controllers) in order to deliver the Services. We carefully vet each sub-processor for security posture, data protection commitments, and lawful basis for any international transfer, and we bind each one to obligations no less protective than those set out in our Data Processing Agreement.
This page is the authoritative source for the current list of sub-processors and is referenced from the DPA.
Current Sub-processors
- SupabaseAuthentication and identity management (sign-in, session tokens, password reset)EU (Frankfurt)Email, name, hashed password, session metadata
- Hetzner Online GmbHPrimary infrastructure: application servers, PostgreSQL database, data-collection workers, object storageGermany (Falkenstein / Nürnberg)Account records, API key metadata, usage and request logs, operational data
- Cloudflare, Inc.DNS, CDN, WAF, and bot/abuse protection (Turnstile)Global edge · EU terminationIP address, request metadata, challenge tokens
- Resend, Inc.Transactional email delivery (account, support, notifications)EU / USRecipient email address, name, message content
International transfers outside the EEA, where applicable, are governed by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) together with supplementary technical and organizational safeguards.
Changes & Notifications
kwery may add, replace, or remove sub-processors from time to time. We will publish any intended change on this page at least thirty (30) days in advance of it taking effect, except where a faster change is required for security or legal reasons.
Customers can subscribe to change notifications by emailing dsb@kwery.co with the subject "Subprocessor change notifications". Customers may object on reasonable data protection grounds during the notice period as set out in Section 5 of the DPA.