AuditFront uses the following third-party sub-processors to provide the Service. Each sub-processor is bound by a data processing agreement and is subject to appropriate safeguards.
Current Sub-processors
| Sub-processor | Purpose | Data Processed | Location | Safeguards |
|---|---|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting (dedicated server) | All application data | Germany (EU) | GDPR-compliant, ISO 27001 |
| Google LLC (OAuth) | Identity provider (social login via Google) | Email address, name, Google account ID | US / EU | SCCs, ISO 27001, SOC 2 |
| Paddle.com Market Ltd | Merchant of record - payment processing, invoicing, sales tax | Email address, subscription status, transaction IDs, billing country | UK / US | SCCs, PCI DSS Level 1, SOC 2 Type II |
| GitHub Inc. (Microsoft) | Source code hosting, CI/CD | Deploy artifacts (no user PII) | US | SCCs, SOC 2 Type II |
| Cloudflare Inc. | Marketing website hosting (Cloudflare Pages), CDN, DDoS protection | IP address, request metadata (marketing site visitors only) | Global (edge network) | SCCs, ISO 27001, SOC 2 Type II |
| Resend Inc. | Transactional email delivery (password reset, account notifications) | Email address, email content | US | SCCs, SOC 2 Type II |
| Google LLC (Analytics) | Website analytics (Google Analytics 4, marketing site only, after cookie consent) | Cookie identifier, IP address (not stored), page views, referrer, device type | US / EU | SCCs, ISO 27001, SOC 2 |
Changes to Sub-processors
We will notify customers of any intended changes to sub-processors at least 30 days in advance. Notifications will be sent via email to the account owner. If you object to a new sub-processor, you may terminate your agreement in accordance with our Terms of Service.
Previous Changes
- 17 September 2026: Google LLC (Analytics) removed when the marketing website stopped using Google Analytics.
- 24 September 2026: Google LLC (Analytics) added again for marketing website analytics that runs only after cookie consent. It does not process data in the application.