Subprocessors
This page lists the third-party service providers that Axion engages to deliver the Service. Each entry describes the role of the subprocessor, the location of its headquarters and the location where personal data is actually processed, the GDPR transfer mechanism we rely on, and links to the subprocessor’s DPA and privacy policy.
We give at least 30 days’ advance notice of any change to this list by updating the “Effective” date above and notifying organisational customers (DPA holders) by email. Consumers can subscribe to changes via the RSS feed.
Current subprocessors
| Name | Purpose | HQ / processing location | Transfer mechanism | DPA | Privacy policy |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Dedicated virtual server hosting (Falkenstein region) for Synapse, Postgres, Redis, MinIO, Vault, Caddy, Sygnal, Mjolnir and Jitsi. | Gunzenhausen, Germany. Data processed in Germany. | Intra-EU; Art. 44 GDPR not engaged. | Hetzner DPA (PDF) | hetzner.com/legal/privacy-policy |
| Cloudflare, Inc. | CDN, DDoS mitigation, edge TLS termination, and authoritative DNS for axionchat.chat. | San Francisco, California, USA. EU edge nodes terminate TLS for EU visitors. | SCCs (Module 3, 2021/914) and EU–US Data Privacy Framework certification. | Cloudflare DPA | cloudflare.com/privacypolicy |
| Migadu Email AG | Outbound transactional email for the axionchat.chat domain (password reset, security alerts). | Schaffhausen, Switzerland. Data processed in Switzerland. | Adequacy decision for Switzerland (Commission Decision 2000/518/EC, renewed 2024). | Migadu DPA | migadu.com/legal/privacy |
| Backblaze, Inc. | Encrypted off-site backup storage (Backblaze B2 Cloud Storage, EU Central region). | San Mateo, California, USA. Data resides in Amsterdam, Netherlands. | SCCs (Module 3, 2021/914). Backups are client-side encrypted with Restic before upload, so Backblaze cannot read the contents. | Backblaze DPA | backblaze.com/company/privacy |
| Google LLC (Firebase Cloud Messaging) | Delivery of push notifications to Android clients via the Sygnal pusher. | Mountain View, California, USA. Edge nodes worldwide. | SCCs (Module 3, 2021/914) and EU–US Data Privacy Framework certification. Only the encrypted notification envelope and the destination FCM token are sent. | Firebase Data Processing Terms | policies.google.com/privacy |
| Apple Inc. (APNs) | Delivery of push notifications to iOS, iPadOS and macOS clients via the Sygnal pusher. | Cupertino, California, USA. EU edge nodes serve EU devices. | SCCs (Module 3, 2021/914). Only the encrypted notification envelope and the destination APNs token are sent. | Apple Internet Services DPA | apple.com/legal/privacy |
| Grafana Labs (Grafana Cloud) | Operational logs and metrics shipped via Grafana Alloy, used for service-health monitoring. No application personal data is shipped to Grafana Cloud; only log lines from server processes are sent, with IPs truncated. | New York, USA; logs ingested in the EU region (Frankfurt). | SCCs (Module 3, 2021/914) and EU–US Data Privacy Framework certification. | Grafana Cloud DPA | grafana.com/legal/privacy-policy |
| UptimeRobot Service Provider Kft. | External uptime monitoring of public health endpoints. Probes only. | Budapest, Hungary. Data processed in the EU. | Intra-EU; Art. 44 GDPR not engaged. | UptimeRobot DPA | uptimerobot.com/privacy-policy |
Optional / federation peers
When you, as a user, choose to invite or join a room with someone whose account lives on another Matrix homeserver, that homeserver becomes a separate independent controller for the events shared in that room. It is not our subprocessor: we do not direct it. We list it here only for transparency and you should review the privacy practices of any homeserver before federating with it.
Changelog
| Date | Change |
|---|---|
| 2026-05-05 | Initial publication of the subprocessors list. |
Contact
Questions or objections to a subprocessor: trust@aevrix.org.