Subprocessors

Last updated: 10 October 2026

About this list

Passback uses the providers below to run Passback. They process personal data on our behalf and are bound by data processing agreements. This list is the one the data processing agreement at https://passback.dev/legal/dpa/ refers to. We tell customers by email at least 30 days before we add or replace a provider.

Subprocessors

  • Hetzner Online GmbH, Germany. Purpose: hosting of the Passback servers and database. Data: account data, site settings, comments waiting for delivery. Location: European Union. Safeguard: not needed, the data stays in the EU.
  • Cloudflare, Inc., United States. Purpose: file storage for screenshots and for encrypted backups (R2, EU jurisdiction), and DNS and sign-in traffic. Data: screenshots; backups are encrypted before they are stored. Location: European Union for stored files. Safeguard: standard contractual clauses and the EU-US Data Privacy Framework.
  • netcup GmbH, Germany. Purpose: hosting of sign-in and user accounts. Data: name, email address, sign-in identifier. Location: European Union. Safeguard: not needed, the data stays in the EU.
  • Stripe Payments Europe, Limited, Ireland, with Stripe, Inc., United States. Purpose: payments, invoices and tax. Data: name, email address, billing country, VAT number, payment details. Location: European Union and United States. Safeguard: standard contractual clauses and the EU-US Data Privacy Framework. Stripe is also a controller for its own fraud and legal duties.
  • Resend, Inc., United States. Purpose: sending service emails such as invoices and notifications. Data: email address and the content of the message. Location: United States. Safeguard: standard contractual clauses.
  • PostHog, Inc., United States. Purpose: counting visits and a few actions on the website and the dashboard (PostHog Cloud, EU region). Data: the address of the page without any query, the browser type, an approximate country, and a random identifier that lasts only for one page view; no name, no email address, no site name, nothing from the widget or from your customers' sites. Location: European Union. Safeguard: standard contractual clauses and the EU-US Data Privacy Framework.

Sign-in providers you choose

If you sign in with Google or GitHub, that provider handles your sign-in under its own privacy policy and is an independent controller, not our subprocessor. We receive only your name, email address and account identifier from it.

Destinations you choose

Passback delivers comments to the issue tracker you connect: Linear, GitHub, Plane or an MCP server of your own. Those services are your own providers. We send the comment to them on your instruction, and what they do with it is governed by your agreement with them, not by this list.

Questions

Write to legal@passback.dev.