// accountability by default

Vendor transparency

This register covers external services currently identified in Unsub's application and deployment configuration. It includes product providers, operational tooling, and conditional services so you can see more than a narrow subprocessor list.

Core hosting: Germany
Company location: Norway
Last reviewed: September 2026

How to read this register

A vendor listed here is not necessarily a subprocessor. Its legal role is stated separately and unresolved classifications are marked for review. Locations and transfer safeguards are based on configuration and provider documentation.

Product infrastructure

2 providers

Hetzner

Hetzner Online GmbH

Hosting provider

Purpose: Hosts Unsub's application, database, queues, and self-hosted cookieless analytics.
Provider based: Germany
Legal role: Processor and subprocessor
Processing location: Germany
Transfer mechanism: No transfer outside the EEA is intended for the configured hosting. Provider terms apply to support and ancillary processing.
European alternative: European provider in use

Accountability note

Core infrastructure is hosted in Germany. The services may share physical or virtual infrastructure; that distinction does not change this inventory.

Hetzner privacy policy

Cloudflare R2

Cloudflare, Inc.

Encrypted backup storage provider

Purpose: Stores encrypted database backups created by Restic.
Provider based: United States
Legal role: Processor and subprocessor
Processing location: European Union R2 jurisdiction
Transfer mechanism: Cloudflare offers a DPA using the EU-US Data Privacy Framework or Standard Contractual Clauses for applicable restricted transfers; account acceptance has not been confirmed.
European alternative: Migration to bunny.net's S3-compatible storage is planned when the service is suitable

Accountability note

Restic encrypts backup data before upload. The R2 bucket uses the EU jurisdiction, which keeps object storage and processing in the EU.

Cloudflare R2 data location Cloudflare DPA

Product services

5 providers

Scaleway Transactional Email

Scaleway S.A.S.

Email delivery provider

Purpose: Delivers account verification, password reset, reminders, notifications, and account-related emails.
Provider based: France
Legal role: Processor and subprocessor
Processing location: Paris region, France (fr-par)
Transfer mechanism: Scaleway states that its DPA forms part of the service contract and applies Standard Contractual Clauses when required for transfers outside the EU.
European alternative: European provider and region in use

Accountability note

Email content and recipient addresses are sent to the configured Paris region for delivery.

Scaleway Transactional Email Scaleway contracts

bunny.net

BunnyWay d.o.o.

Storage and content delivery provider

Purpose: Stores and serves service logos and images uploaded for cancellation guides.
Provider based: Slovenia
Legal role: Processor and subprocessor
Processing location: Primary storage in Frankfurt, Germany, with storage replicas in Singapore, Sydney, Los Angeles, New York, and Sao Paulo
Transfer mechanism: An account-specific DPA is in place. Its contractual safeguards govern processing and replicas outside the EEA.
European alternative: European provider with primary storage in Germany

Accountability note

Frankfurt is the main storage region. The configured storage replicas improve delivery performance but mean copies are also stored outside the EEA.

bunny.net storage replication bunny.net DPA bunny.net privacy policy

Google

Google Ireland Limited for users in Norway

External authentication provider

Purpose: Provides optional Google account sign-in.
Provider based: Ireland, with global operations
Legal role: Third-party authentication service selected by the user
Processing location: Global
Transfer mechanism: Google describes reliance on adequacy decisions, the EU-US Data Privacy Framework, and Standard Contractual Clauses where applicable.
European alternative: Email and password sign-in is available and recommended without Google

Accountability note

Google sign-in remains available for users who prefer it, but Unsub recommends email and password sign-in.

Google terms Google data transfer frameworks

Gravatar

Aut O'Mattic A8C Ireland Ltd. for users in Europe

External avatar provider

Purpose: Provides profile images associated with an MD5 hash of the account email address.
Provider based: Ireland, with global operations
Legal role: Third-party avatar delivery service
Processing location: Global
Transfer mechanism: Automattic describes approved contractual safeguards, including Standard Contractual Clauses, for transfers outside the EEA.
European alternative: Keep in use; no replacement currently planned

Accountability note

A Gravatar URL is generated during email registration and may cause the browser to request an image from Gravatar.

Gravatar terms Automattic privacy policy

FXRatesAPI

A service of Saritra GmbH

Exchange-rate data provider

Purpose: Supplies currency exchange rates used to display subscription totals in a user's preferred currency.
Provider based: Austria
Legal role: Operational data supplier; not sent account or subscription records
Processing location: Not specified in public provider documentation
Transfer mechanism: No customer personal or subscription data is sent; the exchange-rate payload contains only currency codes.
European alternative: European provider in use

Accountability note

Requests contain currency codes and an API credential, not account or subscription records.

FXRatesAPI documentation

Operational services

5 providers

Doppler

Doppler Technologies, Inc.

Secrets management provider

Purpose: Supplies deployment secrets and application configuration to production services.
Provider based: United States
Legal role: Operational processor; not intended to receive application customer content
Processing location: United States and other countries used by the provider and its vendors
Transfer mechanism: Doppler's DPA incorporates Standard Contractual Clauses and additional UK and Swiss terms.
European alternative: Self-hosted alternatives are under evaluation

Accountability note

Customer account content is not intentionally sent to Doppler; it manages operational credentials and configuration.

Doppler privacy notice Doppler DPA

GitHub

GitHub, Inc.

Source code and deployment provider

Purpose: Hosts source code, runs deployment workflows, and stores deployment container images in GitHub Container Registry.
Provider based: United States
Legal role: Operational processor; not part of runtime customer processing
Processing location: United States by default for GitHub.com, with additional provider locations
Transfer mechanism: GitHub's DPA references the EU-US Data Privacy Framework and Standard Contractual Clauses where applicable.
European alternative: Migration to self-hosted Forgejo on Hetzner in Germany is planned

Accountability note

GitHub is part of the software delivery process, not the runtime application path for customer activity.

GitHub privacy statement GitHub DPA

Tailscale

Tailscale Inc.

Deployment network provider

Purpose: Secures deployment access between GitHub Actions and Unsub's infrastructure.
Provider based: Canada
Legal role: Operational processor; not part of application-user traffic
Processing location: Canada, Germany, United States, United Kingdom, and potentially other provider locations
Transfer mechanism: Tailscale's DPA incorporates Standard Contractual Clauses, the UK Addendum, and Swiss modifications.
European alternative: Keep in use; no replacement planned

Accountability note

This is deployment-only networking. It is not used for application-user traffic.

Tailscale privacy policy Tailscale DPA

Grafana Cloud

Raintank Inc. dba Grafana Labs

Application metrics recipient

Purpose: Receives application metrics through OpenTelemetry for operational monitoring.
Provider based: United States
Legal role: Operational processor
Processing location: Grafana Cloud EU Sweden region on AWS eu-north-1
Transfer mechanism: Grafana offers a DPA with Standard Contractual Clauses for applicable transfers, but account acceptance has not been confirmed.
European alternative: Migration planned to a self-hosted Grafana instance on Hetzner in Germany

Accountability note

The application exports metrics every ten seconds. Grafana Cloud will be removed after the internal Hetzner-hosted instance is ready.

Grafana OpenTelemetry documentation Grafana Cloud regions Grafana DPA

Mistral AI

AI model provider

Purpose: Assists administrators with catalog metadata and cancellation-guide drafts from public web content.
Provider based: France
Legal role: Processor under Mistral's DPA for admin-only AI assistance
Processing location: The configured global API endpoint does not make an EEA-only location commitment
Transfer mechanism: Mistral's DPA provides for adequacy decisions or Standard Contractual Clauses where required.
European alternative: European provider in use; migration to Mistral's EU regional endpoint is planned

Accountability note

This admin-only integration is enabled in production. Model training is opted out and zero data retention is enabled. Prompts are designed to exclude account identifiers, emails, subscriptions, transactions, and billing details.

Mistral commercial terms Mistral DPA Mistral regional inference

Conditional services

1 providers

Featurebase

CORDNET OÜ

External feedback portal

Purpose: Collects feedback when a user chooses to open and interact with Unsub's external feedback portal.
Provider based: Estonia
Legal role: External service used at the user's direction
Processing location: Primarily the EEA; ancillary providers may process data outside the EEA
Transfer mechanism: Featurebase's DPA incorporates Standard Contractual Clauses and UK and Swiss addenda.
European alternative: European provider in use

Accountability note

The application links to Featurebase. Visiting and submitting information there is optional.

Featurebase security FAQ Featurebase DPA

Questions or corrections?

Vendor configurations change. If you spot an inaccurate or incomplete entry, contact us at privacy@unsub.cash.