Sub-processor List
Last updated: 23 July 2026
The table below lists every third party we currently use to process personal data on behalf of our customers, in accordance with Section 4 of our Data Processing Agreement (Article 28 GDPR, KVKK Article 12).
Any addition to this list will be posted here at least 14 days before it takes effect. Enterprise customers under a signed DPA will additionally receive the notice by email at the contact address on file.
| Sub-processor | Purpose | Categories of data | Location | Transfer mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH | Application hosting (VM, database, object storage) | All Controller content, authentication metadata | Nuremberg, Germany (EU) | EU/EEA — no third-country transfer |
| Vercel Inc. | Marketing site + dashboard static hosting, edge CDN | IP address, request metadata | Global edge, primary US | EU SCC + supplementary technical measures |
| Cloudflare, Inc. | DNS, DDoS protection, WAF, TLS termination | IP address, TLS metadata, WAF telemetry | Global edge (nearest PoP) | EU SCC + Cloudflare Data Localisation Suite (EU region) |
| Resend, Inc. | Transactional email delivery (verification, invites, alerts) | Recipient email address, message subject/body | US-East (primary), EU delivery infrastructure | EU SCC |
| Functional Software, Inc. (Sentry) | Application error monitoring | Stack traces, request paths, user id (pseudonymised) | EU (Frankfurt) | EU/EEA — no third-country transfer |
| Base (Coinbase L2) | Blockchain anchor for passport tamper-evidence | One-way hash of passport content (no PII, no reversible data) | Public Ethereum L2 network | Hashes are non-personal by design; no personal data crosses this boundary. |
Objection right
If you are a customer under a signed DPA and you have a data-protection concern about a specific sub-processor listed above, please email privacy@izvera.com within 14 days of an addition to raise a formal objection. We will engage in good-faith discussion to address the concern, up to and including offering a migration path or terminating the contract with reimbursement of unused pre-paid fees.