Subprocessors
The providers who process personal data on our behalf, what each receives, and where.
Last updated 2026-09-04
This list forms part of our Data Processing Agreement. Customers are notified before a new subprocessor is added, as set out there.
Infrastructure
| Provider | Purpose | Data received | Location | Safeguard |
|---|---|---|---|---|
| Application hosting | Running the application and collecting its logs | All data processed by the service, and application logs containing account and member identifiers | to be confirmed before launch | to be confirmed before launch |
| Managed PostgreSQL | Primary datastore | Everything described in the privacy policy, section 5 | to be confirmed before launch | to be confirmed before launch |
| Managed Redis | Job queues, locks, rate-limit counters, short-lived detection state | Member identifiers in counters and risk scores; sign-in state; identity held for up to 10 minutes during sign-in | to be confirmed before launch | to be confirmed before launch |
Identity
| Provider | Purpose | Data received | Location | Safeguard |
|---|---|---|---|---|
| Titan Auth (auth.titansoftware.eu) | Single sign-on for the dashboard | Operated by Titan Software z.s. itself, so not a third party. Handles your sign-in credentials; this service receives only the resulting identity claims. | to be confirmed before launch | Same controller |
| Discord Inc. | Gateway, REST API, OAuth2 sign-in, avatar CDN | OAuth token exchange; every protective action with its reason; notification messages containing member identifiers and incident summaries | United States | Independent controller for its own platform. Participant in the EU–US Data Privacy Framework — current certification to be confirmed before launch. |
Not currently used
The following are configurable but not enabled, and receive no data today. They are listed so the position is unambiguous, and because enabling any of them requires this page and the privacy policy to be updated first:
- Error monitoring (Sentry) — no data is sent; the integration is not wired.
- Email delivery (Resend or SMTP) — no email is sent by this service.
- Object storage (S3-compatible) — no file upload path exists; deny-list evidence is limited to notes and links.
- Analytics, advertising and tracking — none, and none planned. Web fonts are self-hosted at build time, so no request reaches a font provider.
Other recipients that are not subprocessors
- Other customers. Where a server opts into the community or global deny lists, or into contributing network early warnings, other subscribing servers receive what is described in the privacy policy, section 6. Those servers are separate controllers, not our subprocessors.
- Your own webhook endpoints. Where you configure an outgoing webhook, we deliver event payloads to the address you choose. You control that destination.
- FiveM servers you monitor. Outbound availability checks only. No personal data is sent.
Questions
Write to [email protected]. You may request a copy of the transfer safeguard relied on for any provider above.