LEGAL · GDPR ARTICLE 28
Subprocessors
HowlOps stores your data in independent, geographically separate EU regions for stability and resilience. Uptime checks additionally run from probe vantage points in other regions (see AWS below), which perform the check and hold results in a short-lived, bounded local queue only until they can be delivered back to the EU — see the AWS row for specifics. The third-party services below help deliver the platform. Controllers are notified 30 days before any new subprocessor is added; the objection window is 30 days per the DPA. Last updated: 2026-08-08.
| Vendor | Purpose | Location | Transfers |
|---|---|---|---|
| Hetzner Online GmbH | Primary compute, storage and database hosting — run across independent, geographically separate regions for resilience | Nuremberg + Helsinki + Falkenstein (DE / FI) | EU only |
| Cloudflare, Inc. | Edge DNS, reverse proxy, load balancing + DDoS protection, and encrypted database backups (R2 object storage) | Global | EU → US (SCCs) |
| Amazon Web Services, Inc. | Independent probe vantage points outside the EU for uptime checks only. Each probe holds a short-lived, size-bounded local queue (check results only — monitor ID, status, response time, and error text; no account or personal data) used solely to retry delivery to our EU backend during a connectivity gap; the queue is capped at 50MB, oldest entries are dropped first if it fills, and it is continuously drained back to the EU once delivery resumes. Nothing is retained on the probe once a result is delivered. EU-region checks run from Hetzner, above. | N. California (US) + Singapore | EU → US + Asia (SCCs) |
| Amazon Web Services EMEA SARL (Amazon SES) | Transactional and alert email delivery — password reset and verification, monitor/incident alerts and digests, status-page subscriber notifications, billing receipts and payment notices, team invitations, and support correspondence. Processes recipient email addresses and names, workspace and monitor/incident details (including customer-authored error text and on-call responder names), billing amounts, and the addresses of a status page's own subscribers. HowlOps does not enable SES content logging, so message content is handled in transit to deliver the email and is not stored by SES afterwards; AWS retains its own bounce/complaint suppression list and sending-reputation metrics under its DPA. | Frankfurt (EU) | EU + US (SCCs) |
| Stripe Payments Europe Ltd | Subscription billing + VAT collection | Ireland | EU + US (SCCs) |
| Twilio Ireland Ltd | SMS + voice alert dispatch, only when a customer configures it for their account | Ireland + US | EU + US (SCCs) |
| Apple Inc. (APNs) + Google LLC (FCM) | Mobile push-notification delivery for the HowlOps app | US | EU → US (SCCs) |
| Google Ireland Ltd (Google Analytics) | Marketing-site analytics, loaded only after cookie consent | EU + US | EU → US (SCCs) |
Object to a new subprocessor: [email protected].