← Back to Privacy Policy
Sub-Processors
Last updated:
HumanKey uses the following third-party sub-processors to provide its services. All sub-processors are bound by Data Processing Agreements (DPAs) and process personal data only as instructed. Where data is transferred outside the EEA, Standard Contractual Clauses (SCCs) per GDPR Chapter V are in place.
| Processor | Purpose | Data Location | Transfer Mechanism | DPA |
|---|---|---|---|---|
| Railway | API server hosting & compute | 🇳🇱 EU (Netherlands — Amsterdam) | EU — no transfer | View DPA |
| Neon | Database hosting | 🇩🇪 EU (Germany — Frankfurt) | EU — no transfer | View DPA |
| Vercel | Frontend hosting & CDN | 🇩🇪 EU (Germany) + 🇺🇸 US (SCCs) | Standard Contractual Clauses (SCCs) | View DPA |
| Cloudflare | DNS, DDoS protection, CDN | 🇺🇸 US + global edge network | Standard Contractual Clauses (SCCs) | View DPA |
| Stripe | Payment processing & subscription billing | 🇺🇸 US (SCCs) | Standard Contractual Clauses (SCCs) | View DPA |
| Resend | Transactional email (verification, password reset) | 🇺🇸 US (SCCs) | Standard Contractual Clauses (SCCs) | View DPA |
| Sentry | Error tracking — no PII transmitted (stripped before transmission) | 🇩🇪 EU (Germany — Sentry EU region) | EU — no transfer | View DPA |
| MaxMind | IP geolocation database — local file download only, no visitor data transferred | 🇺🇸 Waltham, MA, USA | No data transfer (local processing) | View DPA |
| Cloudflare Radar | ASN metadata enrichment via public API — only ASN number queried, no PII transmitted | 🇺🇸 US (Cloudflare global network) | No personal data transfer (public API) | View DPA |
| Anthropic, PBC | AI-powered advisory analytics and chatbot assistance — only aggregated statistics and user chat text transmitted, no visitor data or PII | 🇺🇸 San Francisco, CA, USA | No personal data transfer (aggregated statistics only) | View DPA |
GDPR Compliance
- All EU-based processors are covered under GDPR directly — no transfer mechanism needed.
- US-based processors (Vercel, Cloudflare, Stripe, Resend) have executed EU Standard Contractual Clauses (SCCs) per GDPR Chapter V.
- Sentry operates in EU region (Germany) — no international transfer occurs.
- PII is minimized before transmission to all processors — Sentry receives no email addresses or IP addresses.
We will update this page when sub-processors are added, removed, or changed. Significant changes will be communicated via email to account holders with active subscriptions. This page was last updated on 2026-04-06.