Kupe Cloud Subprocessors
Version: v1.2.0 Last updated: October 9, 2026
This page lists the main third-party providers that we currently use, or expect to use, to deliver Kupe Cloud services where they may process personal data on our behalf. “We” means the company that operates Kupe Cloud, identified in our Privacy Policy at /privacy.
This list focuses on subprocessors and closely related service providers used to deliver the Kupe Cloud service. It may be updated from time to time as our infrastructure and service providers change.
For subprocessor questions, contact privacy@kupe.cloud.
1. Current Subprocessors
| Provider | Service | Location of processing | Data involved |
|---|---|---|---|
| Hetzner Cloud | Hosting and cloud infrastructure for the Kupe Cloud platform | European Union (Germany, Finland) | Tenant contact data, member data, service data, logs, and hosted customer-controlled platform data |
| Cloudflare | DNS, edge network and security, website hosting, Web Analytics, and offsite backup storage | Global edge network (US-headquartered) | Website request metadata, traffic, security and cookieless analytics data, and offsite backups of platform-managed data |
| Paddle | Merchant of record, billing, invoicing, tax, and payment operations | United Kingdom (with global processing) | Billing contact details, subscription and transaction identifiers, invoice and tax data, and limited commercial records |
| Proton AG | Transactional email delivery (verification, invitations, service notices) and business mailbox hosting | Switzerland (UK adequacy) | Recipient email addresses, recipient names, the content of transactional emails sent on our behalf, and correspondence with our support, security, and abuse contacts |
Kupe Cloud manages identity and access services within the hosting infrastructure listed above. These services do not introduce a separate subprocessor.
2. Adding or Replacing Subprocessors
If we engage an additional subprocessor or replace an existing one, we will update this page and provide notice in line with our Data Processing Addendum, including the prior-notice period and objection process described there.
If you need the most current provider list for diligence or procurement review, contact privacy@kupe.cloud.
3. International Transfers
Some providers may process data outside the UK.
Where a restricted transfer occurs, we use an appropriate transfer mechanism required by applicable law, such as an adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses, or another lawful safeguard.
4. Changes
We may update this list from time to time as our services and providers change. The notice period and objection process for new or replacement subprocessors are set out in our Data Processing Addendum at /dpa.
5. Subprocessor Update Notifications
To receive notice of subprocessor changes by email, contact privacy@kupe.cloud to subscribe to subprocessor update notifications.