Sub-processors
Updated · 2026.10.09 · Revision 1.3 · 30-day notice on additions or replacements
Vornin uses the following sub-processors to deliver the service. We will notify tenants by email at least 30 days before adding or removing a sub-processor, giving you time to object before changes take effect.
| Sub-processor | Purpose | Data categories | Location | DPA |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting (app, worker, database) | All customer data | DE, FI | DPA |
| Paddle.com Market Ltd. | Payments (Merchant of Record) | Billing email, name, card last-4, VAT | UK, IE | DPA |
| OpenAI, Inc. | AI-assisted vulnerability triage and false-positive review (platform-wide setting) | Vulnerability titles, descriptions and affected host names; for false-positive review also the rule ID, file path and matched code snippet | US | DPA |
| Cloudflare, Inc. | Turnstile bot-protection on auth and contact | IP address, browser fingerprint | Global edge | DPA |
| Simply.com A/S | DNS and mailboxes | Inbound email to vornin.com mailboxes (sender, subject, body) | DK | DPA |
| Scaleway SAS | Transactional email (sign-in links, notifications, reports, contact-form delivery) | Recipient email, subject, body | FR | DPA |
| Functional Software, Inc. (Sentry) | Error monitoring | Stack traces, scrubbed request context | DE | DPA |
| Grafana Labs (Grafana Cloud) | Centralized application + worker log aggregation (Loki) | Application logs (PII-scrubbed before shipping) | EU (Frankfurt) | DPA |
| Better Stack (Logtail s.r.o.) | Public status page + uptime monitoring | Outbound HTTP probe results, IP of the monitor | EU (Prague) | DPA |
| Google LLC (Google OAuth) | Optional social sign-in (only when a user chooses "Continue with Google") | Email address, name, profile picture URL | US | DPA |
| GitHub, Inc. | Optional social sign-in (only when a user chooses "Continue with GitHub"); read-only code-repository access when a tenant connects a repo | Email address, GitHub username, repo metadata | US | DPA |
| Google LLC (Google Analytics 4) | Aggregated analytics on the public marketing site (vornin.com) only, never on the authenticated app. Consent Mode v2 starts with storage denied and cookieless measurement may occur before consent; analytics requests run through our EU-hosted tagging server. |
Page views, referrer, approximate location, pseudonymous client identifier, IP address and browser/network metadata | US (SCCs) | DPA |
| Google LLC (Google Ads) | Advertising and conversion measurement on the public marketing site (vornin.com) only, never on the authenticated app. Consent Mode v2 starts with advertising storage denied and enabled on marketing consent; cookieless requests may occur before consent, including directly to Google. Conversions also relay server-to-server from our EU-hosted tagging server. |
Page views, IP address, browser/device info, pseudonymous advertising identifier | US (SCCs) | DPA |
| LinkedIn Ireland Unlimited Company (Microsoft) | Retargeting and conversion measurement on the public marketing site (vornin.com) only, never on the authenticated app; fires only after you accept marketing cookies (Consent Mode v2), routed through our EU-hosted tagging server |
Page views, IP address, browser/device info, pseudonymous LinkedIn member identifier | IE | DPA |
| Reddit, Inc. | Retargeting and conversion measurement on the public marketing site (vornin.com) only, never on the authenticated app; fires only after you accept marketing cookies (Consent Mode v2), routed through our EU-hosted tagging server |
Page views, IP address, browser/device info, pseudonymous advertising identifier | US (SCCs) | DPA |
| Cybot A/S (Cookiebot) | Cookie consent management on the public marketing site only | Consent state (anonymous identifier in browser local storage) | DK | DPA |
Change notifications
Owners on every active tenant receive an email whenever this list changes: additions, removals, or material purpose changes. The notice goes out at least 30 days before the change takes effect, with a one-click reply path to object. For machine-readable tracking, link the public page itself; it is the canonical source.
To receive change notifications outside the in-app channel, email privacy@vornin.com.