1.About this list
A subprocessor is a third party we engage that may process personal data in the course of delivering the Service. We hold each to data protection obligations no less protective than our Data Processing Addendum, and we remain responsible to you for their performance.
⚠️ Verify this list against your actual deployment before launch. It reflects the integrations present in the codebase. Remove any provider you do not in fact use, and add any you have added since - an inaccurate subprocessor list is itself a compliance failure, and it is the first thing an enterprise security review will check.
2.Infrastructure
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Hetzner Online GmbH | Dedicated server hosting: application compute, PostgreSQL database, Redis, and disk storage for uploaded files and generated thumbnails. The whole server, database included, is backed up by Hetzner’s own backup service, so backups do not depend on the machine surviving. | All Customer Data and account data at rest. | Germany (EU) |
| GoDaddy (GoDaddy.com, LLC) | Domain registration and authoritative DNS for groundzones.com. | DNS queries only. No Customer Data and no account data. | United States, global anycast |
| Let’s Encrypt (Internet Security Research Group) | Issues the TLS certificate for groundzones.com. TLS terminates on our own server - we use no CDN and no third-party edge network, so visitor IP addresses are not disclosed to an intermediary. | Domain names and one administrative contact address. No Customer Data. | United States |
3.Payments
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Stripe, Inc. | Subscription billing, checkout, customer billing portal, and fraud prevention. | Name, email, billing address, payment method. Stripe acts as an independent controller for payment data; we store only identifiers. | United States, EU |
4.Monitoring and support
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Sentry (Functional Software, Inc.) | Application error monitoring and diagnostics. Only active when a Sentry DSN is configured in the production build. | Error stack traces, IP address, technical context. Tokens, passwords, cookies, and authorization headers are filtered before transmission; default PII collection is disabled. | United States (EU region available) |
| Resend (Plus Five Five, Inc.) | Sends transactional email only: email address confirmation, password reset, security notices such as a password change, and billing lifecycle notifications. No marketing email, and no open or click tracking - links in our emails point directly at groundzones.com and are not rewritten through a tracking domain. | Recipient email address, name, and message content. Verification and password-reset links are single-use, expiring tokens; we never send credentials by email. | Sent from the EU (Ireland) region; Resend’s primary processing and storage take place in the United States. |
5.Geographic data providers
These providers receive location queries - an address string or a coordinate pair - when a lookup is not already cached. They never receive your account identity, your property lists, or your zone definitions.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| OpenStreetMap Foundation (Nominatim) | Geocoding and ZIP code boundary lookups that our self-hosted services cannot answer. | Address strings and coordinates. | United Kingdom, EU |
| Overpass API | Fetching city and administrative boundary geometry from OpenStreetMap. | Boundary queries. No personal data. | EU |
| Photon, Valhalla and map tiles (self-hosted) | Geocoding, routing and map imagery on infrastructure we control. Listed for transparency - no data leaves our environment. | Address strings, coordinate pairs, and map tile requests. | Our infrastructure |
6.Changes to this list
We give at least 30 days’ notice before adding or replacing a subprocessor. Customers with an active DPA may object on reasonable data protection grounds within that window, as described in Section 7.2 of the DPA.
- To be notified of changes, email privacy@groundzones.com with the subject “Subprocessor notifications”.
- Questions about a specific provider: privacy@groundzones.com.