Sub-Processors

Last updated: 2026-10-23

This register lists the companies involved in delivering HumanKey, in four groups: sub-processors of the data we process for our customers (the list the Data Processing Agreement refers to), our processors for account and billing data, independent controllers and other recipients, and sources listed for completeness. For each entry we publish: legal entity, jurisdiction, purpose, data categories, retention, the transfer mechanism under Chapter V of the GDPR where data is transferred, the Data Processing Addendum link where one applies, the vendor's own sub-processor list where one applies, the date we last reviewed the entry, the security certifications the vendor states and — for AI vendors — the relevant AI Act classification.

Data-subject requests: use the /contact form (Privacy & GDPR department).

Sub-processors of Controller data

Processors that process personal data on behalf of our customers (controllers) under the Data Processing Agreement. This table is the list referred to in Section 5.4 of the DPA.

Railway Corp.

Railway · Infrastructure

Last reviewed 2026-10-23

Jurisdiction: United States (Delaware). EEA workloads hosted in the Netherlands (Amsterdam region).
Registered address: 548 Market St, PMB 20429, San Francisco, CA 94104, USA
Processing purpose: Application compute and request routing for the HumanKey API.
Data categories transferred: Request metadata (URL path, timestamp, status), pseudonymised identifiers, transient inbound payloads during processing. IP addresses written to our database are pseudonymised with a keyed cryptographic hash and a daily-rotating salt before write. Railway-managed Redis holds short-lived operational entries: anti-abuse counters and markers keyed by a network address (IPv6 shortened to its network prefix) or by a keyed hash of it, by a keyed hash of an e-mail address, by a site key or by an account id; markers and one-time tokens linked to an account, site or invitation; queued messages and caches; and aggregate counters that identify no person. Railway's platform logs may include the IP address a request came from and its User-Agent.
Retention: Compute layer: requests are processed in memory. Platform logs are kept by Railway for a limited period under its log retention policy. Managed Redis: entries expire automatically or are removed once processed — counters keyed by a network address within 1 hour, entries keyed by a hashed network or e-mail address within 24 hours, entries linked to an account or site within 180 days, aggregate counters within 400 days.
Transfer mechanism (GDPR Art. 46): EU data residency (Netherlands) for production workload; Standard Contractual Clauses 2021/914 cover control-plane access from US.
Data Processing Addendum: View DPA →
Sub-processor chain (Art. 28(4)): See vendor's own sub-processor list →
Security certifications: SOC 2 Type II

Databricks, Inc. (parent company of Neon, LLC)

Neon · Infrastructure

Last reviewed 2026-10-23

Jurisdiction: United States (Delaware). EEA database stored in Germany (AWS eu-central-1 Frankfurt).
Processing purpose: Managed PostgreSQL hosting for account data, site configuration, and analytics aggregates.
Data categories transferred: Account records (email, hashed password, account settings), site configuration, pseudonymised visit records, aggregated counts.
Retention: Stored per HumanKey retention policy (7–365 days by plan tier); backup copies expire on the database provider's backup cycle.
Transfer mechanism (GDPR Art. 46): EU data residency (AWS Frankfurt) for production database; Standard Contractual Clauses 2021/914 cover control-plane access from US.
Data Processing Addendum: View DPA →
Sub-processor chain (Art. 28(4)): See vendor's own sub-processor list →
Security certifications: SOC 2 Type IIISO 27001

Vercel Inc.

Vercel · Infrastructure

Last reviewed 2026-10-23

Jurisdiction: United States (Delaware).
Registered address: 440 N Barranca Ave #4133, Covina, CA 91723, USA
Processing purpose: Frontend hosting, edge routing, and CDN delivery for humankey.io.
Data categories transferred: HTTP request metadata (URL, User-Agent, referrer, IP address), static asset delivery logs. No account data persisted.
Retention: Edge logs are kept under Vercel's log retention policy.
Transfer mechanism (GDPR Art. 46): Standard Contractual Clauses 2021/914.
Data Processing Addendum: View DPA →
Sub-processor chain (Art. 28(4)): See vendor's own sub-processor list →
Security certifications: SOC 2 Type IIISO 27001

Cloudflare, Inc.

Cloudflare · Infrastructure

Last reviewed 2026-10-23

Jurisdiction: United States (Delaware).
Registered address: 101 Townsend Street, San Francisco, CA 94107, USA
Processing purpose: Network security and content delivery for the HumanKey website and service; forwarding of e-mail sent to HumanKey addresses.
Data categories transferred: Request metadata (URL, User-Agent, referrer), transient IP addresses for DDoS defence. Inbound e-mail: sender and recipient addresses, subject, body and attachments of messages sent to humankey.io addresses, processed in transit and passed to HumanKey (Neon, EU). No long-term storage by HumanKey configuration.
Retention: Security logs retained per Cloudflare retention policy (see vendor link).
Transfer mechanism (GDPR Art. 46): Standard Contractual Clauses 2021/914.
Data Processing Addendum: View DPA →
Sub-processor chain (Art. 28(4)): See vendor's own sub-processor list →
Security certifications: SOC 2 Type IIISO 27001PCI DSSFedRAMP Moderate

Resend, Inc.

Resend · Email

Last reviewed 2026-10-23

Jurisdiction: United States (Delaware).
Registered address: 2261 Market Street #4667, San Francisco, CA 94114, USA
Processing purpose: Transactional and service email delivery on HumanKey's behalf. Categories include: account and authentication messages (address verification and e-mail-address change confirmation, magic-link sign-in, password reset and password-change notices); account, team and site administration (team invitations, domain-claim notices, site disable and deletion notices); billing and subscription notices (receipts, invoices, payment and refund outcomes, plan, quota and downgrade notices); onboarding and installation instructions, including messages sent at the account holder's request to a technical contact whose address the account holder supplies; periodic reports and alerts derived from the customer's own site analytics (AI-crawler and bot digests, new-crawler alerts); and support responses. HumanKey composes every message; Resend transmits it. Resend does not receive inbound mail for HumanKey: contact-form submissions are written directly to HumanKey's own database (Neon, EU), and e-mail sent to humankey.io addresses is routed by Cloudflare (see the Cloudflare entry). These are categories of message, not an exhaustive list.
Data categories transferred: Recipient email address, email subject and body (assembled by HumanKey), delivery metadata (bounce, open, click events).
Retention: Sent messages (including their content) and delivery logs are kept by Resend under its retention policy (see vendor link).
Transfer mechanism (GDPR Art. 46): Standard Contractual Clauses 2021/914.
Data Processing Addendum: View DPA →
Sub-processor chain (Art. 28(4)): See vendor's own sub-processor list →
Security certifications: SOC 2 Type II

Functional Software, Inc. d/b/a Sentry

Sentry · Monitoring

Last reviewed 2026-09-30

Jurisdiction: United States (Delaware). HumanKey tenant configured for EU region (Frankfurt) — errors ingested and stored in the EU.
Registered address: 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA
Processing purpose: Application-error monitoring and diagnostic capture for the HumanKey API and dashboard.
Data categories transferred: Stack traces, runtime error context, release identifiers. Personal identifiers (email, IP, user-agent) are stripped on the client, server, and edge before transmission per HumanKey Sentry SDK configuration.
Retention: Error events are kept under Sentry's retention policy.
Transfer mechanism (GDPR Art. 46): EU data residency (Sentry EU region, Frankfurt); no international transfer occurs. Standard Contractual Clauses 2021/914 cover control-plane access from US.
Data Processing Addendum: View DPA →
Sub-processor chain (Art. 28(4)): See vendor's own sub-processor list →
Security certifications: SOC 2 Type IIISO 27001

Anthropic, PBC

Anthropic · AI / LLM inference

Last reviewed 2026-10-15

Jurisdiction: United States (Delaware public benefit corporation).
Registered address: 548 Market Street, PMB 90375, San Francisco, CA 94104, USA
Processing purpose: Large-language-model inference powering: (a) the public AI Assistant chatbot, (b) automated audit summarisation, (c) admin-only AI Insights advisory analytics and automated bot research, (d) customer-facing advisory features (traffic insights, crawler recommendations, the daily-report sentence) and (e) where the customer uses them on a plan that includes them, optional texts drafted with an AI model for the customer's own website (for example page descriptions, answers to frequent questions or a summary for an llms.txt file), shown as drafts for the customer to review before use. All outputs are advice or drafts; the customer decides what to publish; no automated decision under GDPR Art. 22.
Data categories transferred: AI Assistant: user-submitted chat text, system prompts assembled by HumanKey and, for signed-in users, coarse account context (for example plan tier, number of sites, feature usage, a traffic-volume band). Customer-facing AI features (traffic insights, crawler recommendations, the daily-report sentence): aggregate per-site and per-crawler counts and, depending on the feature, the site domain, its public robots.txt and its crawler allow/block settings. Optional AI-drafted texts (where the customer uses them): excerpts of the content of the customer's own public pages and files (for example page text and titles, or an existing robots.txt or llms.txt file), the site domain and page addresses, and the settings the customer chooses for the draft (for example the language). Automated bot research and administrator analytics: User-Agent strings of visits classified as automated (full or truncated), aggregate counts and, for administrator-initiated labelling, numeric interaction features of individual sessions. HumanKey never adds an IP address, IP hash, session identifier, the account's e-mail address, payment data or a session token. Chat text, a domain name, page or file content (for example an author's name or a contact address published there) or a User-Agent string may constitute personal data within the meaning of GDPR Art. 4(1).
Retention: Anthropic retains API inputs and outputs for up to 30 days for trust and safety purposes, after which they are generally deleted (subject to limited trust-and-safety exceptions), and does not use them to train its models.
Transfer mechanism (GDPR Art. 46): Standard Contractual Clauses 2021/914.
Data Processing Addendum: View DPA →
Sub-processor chain (Art. 28(4)): See vendor's own sub-processor list →
Security certifications: SOC 2 Type IIISO 27001ISO 42001
AI Act classification (Regulation (EU) 2024/1689): HumanKey integrates a general-purpose AI model supplied by Anthropic into its own AI Assistant, advisory features and optional drafting features. The AI Assistant tells users that they are interacting with an AI system (see /legal/ai-transparency).

Our processors for account and billing data

Processors we use for data about our customers' accounts and billing, for which we are the controller (Privacy Policy). They do not process the data we process on behalf of customers.

Stripe Payments Europe, Limited (EEA flows) — with Stripe, Inc. (US, technology provider)

Stripe · Payments

Last reviewed 2026-10-23

Jurisdiction: Ireland (Stripe Payments Europe, Limited handles EEA payment flows); United States (Stripe, Inc. provides technology platform under SCCs).
Registered address: Stripe Payments Europe, Limited — 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland
Processing purpose: Payment processing, subscription billing, invoicing, and chargeback management.
Data categories transferred: Account e-mail address and account identifier, billing identity (name, billing address, NIP/VAT number when applicable), payment instrument metadata (card brand, last 4, expiry — full card number tokenised by Stripe), invoice history, subscription state.
Retention: Retained by Stripe for legal and tax compliance purposes under Stripe's retention policy, also after the HumanKey account is deleted.
Transfer mechanism (GDPR Art. 46): EEA payment processing under Stripe Payments Europe, Limited (Ireland — GDPR direct); technology platform access from US under Standard Contractual Clauses 2021/914 + EU-US Data Privacy Framework.
Data Processing Addendum: View DPA →
Sub-processor chain (Art. 28(4)): See vendor's own sub-processor list →
Security certifications: PCI DSS Level 1SOC 1 Type IISOC 2 Type IIISO 27001

Independent controllers and other recipients

Companies that receive or provide personal data under their own terms and privacy policies, not as our processors.

Google Ireland Limited (EEA users) / Google LLC (US technology provider)

Google · Authentication (optional)

Last reviewed 2026-10-15

Jurisdiction: Ireland (Google Ireland Limited, for users in the EEA and Switzerland); United States (Google LLC).
Registered address: Google Ireland Limited — Gordon House, Barrow Street, Dublin 4, Ireland
Processing purpose: OAuth 2.0 authentication when a user chooses Google as the sign-in method. Optional — only invoked at explicit user request. Google acts under its own terms and privacy policy, not as our processor.
Data categories transferred: From Google to HumanKey, during sign-in. Google sends: an account identifier, the e-mail address, whether Google has verified that address, the name and, depending on the Google account, further profile fields (for example a profile-picture address). HumanKey reads: the identifier, the e-mail address, the verification flag and the name. HumanKey keeps: the identifier and — when the sign-in creates a new account — the e-mail address and the name. Google's access token is used for one request during sign-in and is not stored. No password is transmitted to HumanKey.
Retention: HumanKey keeps the Google account identifier, the e-mail address and the name in the user account until the account is deleted; Google keeps data under its own privacy policy and the user's Google Account settings.
Transfer mechanism (GDPR Art. 46): Not a transfer to our processor: the user signs in at Google; Google sends HumanKey the data listed under data categories.
Data Processing Addendum: Not applicable — not our processor
Sub-processor chain (Art. 28(4)): Not applicable
Security certifications: SOC 2 Type IIISO 27001ISO 27017ISO 27018

Sources listed for completeness

Companies whose public files or databases we download. We send them no personal data; they are not our processors.

MaxMind, Inc.

MaxMind · Geolocation (data-source import)

Last reviewed 2026-09-30

Jurisdiction: United States (Massachusetts).
Registered address: 51 Pleasant Street #1020, Malden, MA 02148, USA
Processing purpose: One-way database import. HumanKey downloads the GeoLite database files periodically; country and network-operator lookups are performed locally. No visitor data is sent to MaxMind. This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com.
Data categories transferred: None transmitted. HumanKey only downloads the database files from MaxMind servers.
Retention: Not applicable — no personal data processed by MaxMind on HumanKey behalf.
Transfer mechanism (GDPR Art. 46): Not applicable — one-way file download; no personal data transfer to the vendor.
Data Processing Addendum: Not applicable — not our processor
Sub-processor chain (Art. 28(4)): Not applicable
Security certifications: SOC 2 Type II

OpenAI, L.L.C.

OpenAI (crawler ranges) · Crawler range files (data-source import)

Last reviewed 2026-09-30

Jurisdiction: United States.
Processing purpose: One-way import of the public IP-range files OpenAI publishes for its crawlers. HumanKey downloads the files on a fixed schedule and performs range matching locally, to check whether traffic presenting an OpenAI crawler User-Agent actually originated from an address OpenAI publishes. No visitor data is sent to OpenAI.
Data categories transferred: None transmitted. HumanKey only downloads a public file; the request carries no query string, no visitor IP and no customer identifier.
Retention: Not applicable — OpenAI processes no personal data on HumanKey behalf.
Transfer mechanism (GDPR Art. 46): Not applicable — one-way public file download; no personal data transfer to the vendor.
Data Processing Addendum: Not applicable — not our processor
Sub-processor chain (Art. 28(4)): Not applicable
Security certifications: Not published

Google LLC

Google (crawler ranges) · Crawler range files (data-source import)

Last reviewed 2026-09-30

Jurisdiction: United States.
Processing purpose: One-way import of the public IP-range files Google publishes for its crawlers. HumanKey downloads the files on a fixed schedule and performs range matching locally, to check whether traffic presenting a Google crawler User-Agent actually originated from an address Google publishes. No visitor data is sent to Google.
Data categories transferred: None transmitted. HumanKey only downloads a public file; the request carries no query string, no visitor IP and no customer identifier.
Retention: Not applicable — Google processes no personal data on HumanKey behalf under this dependency.
Transfer mechanism (GDPR Art. 46): Not applicable — one-way public file download; no personal data transfer to the vendor.
Data Processing Addendum: Not applicable — not our processor
Sub-processor chain (Art. 28(4)): Not applicable
Security certifications: Not published

Microsoft Corporation

Bing (crawler ranges) · Crawler range files (data-source import)

Last reviewed 2026-09-30

Jurisdiction: United States.
Processing purpose: One-way import of the public IP-range file Microsoft publishes for the Bing crawler. HumanKey downloads the file on a fixed schedule and performs range matching locally, to check whether traffic presenting a Bing crawler User-Agent actually originated from an address Microsoft publishes. No visitor data is sent to Microsoft.
Data categories transferred: None transmitted. HumanKey only downloads a public file; the request carries no query string, no visitor IP and no customer identifier.
Retention: Not applicable — Microsoft processes no personal data on HumanKey behalf under this dependency.
Transfer mechanism (GDPR Art. 46): Not applicable — one-way public file download; no personal data transfer to the vendor.
Data Processing Addendum: Not applicable — not our processor
Sub-processor chain (Art. 28(4)): Not applicable
Security certifications: Not published

Apple Inc.

Apple (crawler ranges) · Crawler range files (data-source import)

Last reviewed 2026-10-04

Jurisdiction: United States.
Processing purpose: One-way import of the public IP-range file Apple publishes for its Applebot crawler. HumanKey downloads the file on a fixed schedule and performs range matching locally, to check whether traffic presenting an Applebot User-Agent actually originated from an address Apple publishes. No visitor data is sent to Apple.
Data categories transferred: None transmitted. HumanKey only downloads a public file; the request carries no query string, no visitor IP and no customer identifier.
Retention: Not applicable — Apple processes no personal data on HumanKey behalf under this dependency.
Transfer mechanism (GDPR Art. 46): Not applicable — one-way public file download; no personal data transfer to the vendor.
Data Processing Addendum: Not applicable — not our processor
Sub-processor chain (Art. 28(4)): Not applicable
Security certifications: Not published

Legal framework

GDPR Art. 28— every processor is bound by a written Data Processing Agreement with documented instructions, confidentiality obligations, security measures, sub-processor terms, and audit rights.
GDPR Art. 46 / Chapter V— transfers outside the EEA rely on Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), the EU-US Data Privacy Framework where the vendor is certified, or local-EEA residency where available.
GDPR Art. 28(2) and (4)— the first table lists the sub-processors of the data we process for our customers; before one is added or replaced, account holders are informed in advance and may object (Data Processing Agreement, Section 5.4). Each vendor's own sub-processor list is linked in its entry.
AI Act Regulation (EU) 2024/1689 Art. 50— where an AI vendor is engaged, transparency obligations for the public chatbot surface are documented on the AI Transparency page.

We update this page when a sub-processor is added, removed or replaced, or when a description is corrected. Before a sub-processor of Controller data is added or replaced, account holders are informed in advance by e-mail and on this page and may object (Data Processing Agreement, Section 5.4). Last updated: 2026-10-23.