Sub-processors
Current as of 2026-10-01
These are the third parties that process data on behalf of Trusted Codes. The list carries its own date, because it changes when a supplier changes rather than when a contract does.
It is also Annex 2 of the Data Processing Agreement, and Section 12 of the Privacy Policy. All three are rendered from one source, so they cannot disagree.
Core service
Engaged for every customer of the hosted service.
| Provider | Purpose | Location | Data shared | Transfer basis |
|---|---|---|---|---|
| Supabase | Database, authentication, server functions and file storage | European Union (Stockholm); operator established in the United States | All account, verification and billing data held by the service | Standard Contractual Clauses (2021/914) |
| Infisical | Custody of the keys that protect data at rest | European Union | Encryption keys only — no personal data | Inside the EEA |
| Vercel | Hosting of the public website, the pages and server functions of app.trusted.codes, and the web portals | Server functions in the European Union (Frankfurt); static files from Vercel’s global network; operator established in the United States | Request metadata: IP address, user agent, requested path; the content of forms and requests handled by server functions | Standard Contractual Clauses (2021/914) |
| Resend | Delivery of transactional electronic mail | European Union (Ireland); operator established in the United States | Electronic mail address and message content, decrypted for the moment of sending | Standard Contractual Clauses (2021/914) |
| OpenAI | The in-app assistant on Trusted Codes’ own key: understanding requests, composing answers, and search vectors for help texts and questions | United States (Standard Contractual Clauses); API data kept up to 30 days for abuse detection | The text of the request, which can contain whatever the user typed, and excerpts from the help texts. Not used to train models. | Standard Contractual Clauses (2021/914) |
| Sentry | Error reports from the mobile application, the desktop application, the web portals, the administration console and the website | European Union (Germany); operator established in the United States | Stack trace, application version, device model or browser, account identifier. No electronic mail address and no IP address. | Standard Contractual Clauses (2021/914) |
| Stripe | Payment processing and subscription billing | Stripe Payments Europe Ltd, Ireland; processing also in the United States | Billing name and address, tax identification number, subscription state. Card data never reaches Trusted Codes. | Standard Contractual Clauses (2021/914) |
| Expo | Relay of push notifications to the Apple and Google delivery services, and delivery of updates to the mobile application | United States | Push token, notification content, IP address of the device | Standard Contractual Clauses (2021/914) |
| MaxMind | Fraud check at sign-in and registration | United States | IP address, electronic mail address, user agent. Trusted Codes keeps the result: a risk score and a location to city level. Request and response content is not logged. | Standard Contractual Clauses (2021/914) |
| Hetzner Online GmbH | Rented server on which Trusted Codes operates Plausible Analytics, Metabase and the MCP relay | Germany (Nuremberg) | The data of those three services, as described in their rows | Inside the EEA |
| Plausible Analytics | Usage statistics for the website and the applications of the service | Germany, on a server rented from Hetzner | Page viewed and referrer, with no cookies. The IP address is processed only in memory, to form a hash that changes every day. | Operated by Trusted Codes |
| Metabase | Internal analytics, used only by the operator | Germany, on a server rented from Hetzner | Figures queried from the service database | Operated by Trusted Codes |
| MCP relay (mcp.trusted.codes) | Passing requests between an AI client and the user’s desktop application | Germany, on a server rented from Hetzner | No content is stored. Connection logs (user name derived from the electronic mail address, IP address, time) are kept for 7 days. | Operated by Trusted Codes |
Optional and user-chosen
Engaged only where the end user chooses the feature, or where the component is configured.
| Provider | Purpose | Location | Data shared | Transfer basis |
|---|---|---|---|---|
| Apple | Sign-in, where the end user chooses it | United States | Name and electronic mail address, or the relay address Apple issues instead | Standard Contractual Clauses (2021/914) |
| Sign-in, where the end user chooses it | United States | Name and electronic mail address | Standard Contractual Clauses (2021/914) |
Store test programme
Engaged while the mobile application is distributed through a store test programme.
| Provider | Purpose | Location | Data shared | Transfer basis |
|---|---|---|---|---|
| Google (Workspace) | Tester group for the store test of the Android application | United States | Electronic mail address of the tester. It is removed when the account is deleted. | Standard Contractual Clauses (2021/914) |
Public website only
These handle visitors to trusted.codes, not users of the service.
| Provider | Purpose | Location | Data shared | Transfer basis |
|---|---|---|---|---|
| Google (Sheets and Apps Script) | Receiving the website contact form and the waiting list form, during the test period only | United States | Name, electronic mail address, subject and message. The sheet is deleted when the test period ends. | Standard Contractual Clauses (2021/914) |
A new sub-processor is announced at least 30 days before it begins processing, by electronic mail to the administrative contact of each business customer and by an update to this page.