Sub-processors
No sub-processors are engaged for instance workloads. The hardware is GPUwerk's own, it sits in EU-Central, and nobody else is in that path: no third party accesses, stores, or otherwise processes the content of a customer's instance. The list below covers the processors used for the website, sign-in, and billing side of the service, as described in our Privacy Policy, section 5, plus the error-reporting, analytics and marketing processors named in that same section. The rows marked consent-gated are only loaded, and only receive data, if you accept the corresponding category in the cookie banner; nothing is fetched from them beforehand.
| Sub-processor | Purpose | Entity and location | Data involved |
| Stripe | Payments and invoicing | Stripe Payments Europe, Limited, Dublin, Ireland | Card and billing data. Card details are entered on Stripe's own payment page and never reach GPUwerk's servers. |
| Resend | Transactional email: sign-in notices, receipts, low-balance and closure warnings | Plus Five Five, Inc., San Francisco, California, United States | Recipient email address and message content. This is a transfer to the United States; see the Privacy Policy, section 6. |
| Hetzner Online GmbH | Server hosting for the control plane, console, this website, and the account database | Germany (Hetzner Cloud server in Helsinki, Finland) | Account and billing data. Inside the EU. |
| Cloudflare | DNS only, for gpuwerk.com | Global DNS network | DNS queries only. Traffic to the site and console is not proxied through Cloudflare; it goes straight to our server, so Cloudflare does not see requests, IP addresses, or traffic. |
| Sentry | Error reporting: catches JavaScript errors on the website and console | EU region | No cookie set, no identifier stored; personal data collection, IP capture and session replay are all off. Legal basis is legitimate interest, Article 6(1)(f) GDPR, not consent, so this one is not gated by the cookie banner. |
| PostHog Consent-gated: analytics | Website analytics: which pages fail, in aggregate | PostHog, EU region | Session recording and autocapture off, IP discarded at ingest. Loaded and receives data only if you accept the analytics category in the cookie banner. Stays in the EU: no third-country transfer. |
| Google Analytics 4 Consent-gated: analytics | Website analytics: which pages fail, in aggregate | Google, United States | Loaded and receives data only if you accept the analytics category in the cookie banner; refusing means the script is never fetched. When accepted, this is a transfer to the United States under the EU–US Data Privacy Framework adequacy decision, or standard contractual clauses otherwise; see Privacy Policy section 6. |
| Google Ads Consent-gated: marketing | Marketing: attributing a signup to the advert that produced it | Google, United States | Loaded and receives data only if you accept the marketing category in the cookie banner. Events sent are page and content views, a submitted contact form, and the first sign-in in the console; no names, email addresses or message contents. Transfer basis as above. |
| Meta pixel Consent-gated: marketing | Marketing: attributing a signup to the advert that produced it | Meta, United States | Loaded and receives data only if you accept the marketing category in the cookie banner. Events sent are page and content views, a submitted contact form, and the first sign-in in the console; no names, email addresses or message contents. When accepted, this is a transfer to the United States under the EU–US Data Privacy Framework adequacy decision, or standard contractual clauses otherwise; see Privacy Policy section 6. |
GitHub and Google are not sub-processors. If you sign in through one of them, they act as independent controllers for what happens on their side, governed by their own privacy policy. They learn that you have an account with GPUwerk; nothing more passes through this relationship. Signing in with an email address instead involves neither of them.
Full detail on legal basis, retention, and international transfers for each of these is in our Privacy Policy. Our Article 28 data processing agreement is at /legal/dpa.
Changes
This list is updated at this address as sub-processors change. We give account holders at least 30 days' notice by email before a new sub-processor is engaged, so there is time to review it or object.