Sub-processors
Last updated: 2026-10-09
Maintained pursuant to Art. 28 GDPR and the SentriKat Data Processing Agreement.
About this list
SentriKat uses the following third-party sub-processors to provide and support our services. Each sub-processor is bound by data processing agreements that impose obligations no less protective than those set out in our DPA.
We will notify customers before adding or changing a sub-processor. To receive notifications, subscribe to updates at [email protected].
Current Sub-processors
| Sub-processor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Cloud infrastructure, virtual servers hosting the Cloud platform, license server, and website | Germany / Finland | EU (no transfer) |
| Cloudflare, Inc. | DNS, CDN and reverse proxy for all our public sites (website, portal, API, license server, documentation, community, Cloud app), DDoS protection, Turnstile (bot protection for forms), and routing of incoming email to our mailboxes | United States | EU-US Data Privacy Framework |
| Resend, Inc. | Transactional email (confirmations, license delivery, newsletter) | United States | EU-US Data Privacy Framework |
| Stripe, Inc. | Payment processing (activated when billing is enabled for your account) | United States / Ireland | EU-US Data Privacy Framework + Irish entity for EU data |
| GitHub, Inc. (Microsoft) | Source code hosting, CI/CD pipelines, release management | United States | EU-US Data Privacy Framework |
On-Premises Deployments
The SentriKat on-premises edition runs entirely on the Customer's own infrastructure. In this deployment mode, SentriKat does not act as a data processor, and no personal data is transmitted to SentriKat or any sub-processor. The external connections are: a periodic license validation heartbeat from licensed installations (license key, installation identifier, version, and knowledge-base freshness counters, none of it personal data), and, for installations that keep the optional knowledge-base sync enabled, anonymized software identification signals as described in our Privacy Policy. Neither carries a hostname, an IP-identified individual, or any Customer Data.
Changes to this list
SentriKat will provide at least 30 days' notice before engaging a new sub-processor or materially changing the purpose of an existing one. Customers who object may contact us at [email protected] within the notice period.
Contact
For questions about sub-processors or data processing:
Denis Sota
SentriKat, Data Protection
Email: [email protected]