Subprocessors
Sub-processors#
This page lists the third-party services that process customer data on our behalf. Updated 2026-05-14.
Linked from: Privacy Policy §5
Active sub-processors#
| Provider | Purpose | Data processed | Region |
|---|---|---|---|
| Cloudflare, Inc. | DNS, CDN, WAF, tunnel | Request metadata (IPs, paths), DNS records | Global edge |
| Hetzner Online GmbH | Managed control-plane hosting | All control-plane data at rest | EU (Falkenstein, Germany) |
| Stripe, Inc. | Payment processing (when applicable) | Cardholder name, last 4, billing address | US + EU |
| OpenAI, L.L.C. | LLM inference for the docs drafter (when you opt in) | Document drafts + your repo file previews you choose to feed it | US |
| Resend | Transactional email (verification, billing receipts) | Account email address only | US + EU |
Not currently used#
We do not use, and have no plans to use:
- Google Analytics or similar tracking pixels
- Facebook / Meta Pixel
- Hotjar / FullStory / session-replay tools
- Snowflake / BigQuery / data-lake exports of customer data
- Any AI/ML training on your data (the OpenAI use above is per-request inference only, not training)
Notification policy#
We will email all account owners at least 30 days before adding a new sub-processor that handles personal data. You can object via [email protected] — we'll work with you to find an acceptable workaround or, if none exists, refund the unused portion of your prepaid term.
Self-hosted note#
When you self-host the agent, none of the above sub-processors receive your data unless you explicitly configure them (e.g. setting OPENAI_API_KEY in your docs-backend .env). The control plane sub-processors only apply if you use the hosted plane at panel.gritiva.com.
Data Processing Agreement#
A standard DPA is available on request. Email [email protected] with your company name and we will counter-sign within 5 business days.