Subprocessors
Who processes data for Typestate, where, and on which basis. As of 28 September 2026.
This list belongs to the data processing agreement (section 6). We announce a change in text form at least 30 days in advance.
For the data in your backends
| Provider | Service | Place of processing | Basis for a transfer |
|---|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Server for the cockpit, MCP server, platform database and translation; nightly backup | Germany | No transfer to a third country |
| Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA | Running the backends and websites, their databases and files, network and TLS for all requests | Cloudflare's global network | EU-US Data Privacy Framework (Article 45 GDPR), in addition standard contractual clauses (Article 46(2)(c) GDPR) |
| Better Stack, Inc., USA | Log collection and monitoring. Logs can contain IP addresses and identifiers of your users | EU (Nuremberg, Germany) | For access from the USA: standard contractual clauses (Article 46(2)(c) GDPR) in Better Stack's agreement |
For translating your descriptions
These providers receive only the descriptions of your actions and the tests you write, so that a language model turns them into program code. The records of your backends and the data of your users are not sent to them. Personal data reaches them only if somebody writes it into a description or a test, contrary to section 8(4) of the terms.
| Provider | Service | Place of processing | Contract and basis for a transfer |
|---|---|---|---|
| OpenRouter, Inc., 169 Madison Avenue, New York, NY 10016, USA | Routing to the language model for translation | USA | No contract under Article 28 GDPR and no standard contractual clauses yet. We have asked for both |
| Deep Infra Inc., 2625 Middlefield Road #460, Palo Alto, CA 94306, USA, through OpenRouter | Running the DeepSeek language model, the default translation path | USA | No contract under Article 28 GDPR and no standard contractual clauses yet. We have asked for both |
| Anthropic Ireland, Limited, South Bank House, Barrow Street, Dublin 4, Ireland, with Anthropic, PBC, USA | Claude language model, the second translation path | USA | Standard contractual clauses (Article 46(2)(c) GDPR) in Anthropic's agreement |
The DeepSeek model is an open model. DeepSeek itself receives no data.
For our own data
These providers process data for which we ourselves are the controller, for example your account and your email to us. They are listed here for completeness. The details are in the privacy notice.
| Provider | Service | Place of processing |
|---|---|---|
| Plus Five Five, Inc. (Resend), San Francisco, USA | Sending the platform's email (sign-in, confirming your email address, password) | USA |
| Google Cloud EMEA Limited, Dublin, Ireland (Google Workspace) | Mailbox hello@typestate.com | EU and USA |
| Stripe Payments Europe, Limited, Dublin, Ireland | Payments for Typestate's paid plans | EU and USA |
Not on this list
The payment provider and the email provider you choose yourself for your backend conclude their contract with you. They are recipients you designate and not subprocessors of Typestate (data processing agreement, section 2(6)).