Trust / Subprocessors
Subprocessors
The third parties we use to run the service, each one named, with where it sits. Every subprocessor in the table below stores your data in the EU; where one has a parent company outside the EEA, the transfer is covered by standard contractual clauses and the row says so. This list matches Annex III of our data processing agreement.
| Subprocessor | Purpose | Location and safeguard |
|---|---|---|
| Hetzner | Cloud hosting and managed database | Germany. EU-incorporated company, EU-hosted. No transfer outside the EEA. |
| Cubbit | Object storage and backups | Italy. EU-incorporated company, data stored across the EU. No transfer outside the EEA. |
| mailbox.org | Email mailboxes and inbound (receiving) email | Germany. EU-incorporated company, EU-hosted. No transfer outside the EEA. |
| Scaleway | Transactional email sending (onboarding, billing, notifications) | France. EU-incorporated company (Scaleway S.A.S., Paris, Iliad group), EU-hosted (Paris fr-par). No transfer outside the EEA. |
| PostHog | Product analytics and session recordings (consent-gated) | Germany (Frankfurt). EU-hosted. US parent company; transfers covered by standard contractual clauses. |
Payments
Stripe acts as our merchant of record, handling checkout, billing, VAT, and invoicing. Our contracting entity is Stripe Payments Europe, Limited (Ireland). Stripe is an independent controller for the payment and tax data it handles, not a subprocessor under our data processing agreement, so it sits outside the table above and is governed by its own terms.
Sign-in with Google or GitHub
You can sign in with Google or GitHub instead of an email address and password. Both are optional. If you choose one, that provider tells us your name, email address, whether that address is verified, your profile picture, and your account identifier with them. We store those, and the tokens that keep the link working, in the EU alongside the rest of your account. We send the provider no personal data about you: your browser goes to them, you approve the sign-in there, and we receive the result.
Google and GitHub are United States companies. Each is an independent controller for your account with them, under its own privacy policy, and neither is a subprocessor under our data processing agreement, so they sit outside the table above. Choosing one means that provider knows you signed in to Paperclip.inc. Email and password, a magic link, or a passkey involve neither of them. In no case is your organization's content, agent runs, or billing data shared with either provider.
Changes
We keep this list current. Before we add or replace a subprocessor, we give reasonable prior notice by updating this page, and customers may object on reasonable data-protection grounds within 15 days, as set out in our data processing agreement. To be notified of changes, email privacy@paperclip.inc.