Sub-processors
Last updated: October 27, 2026
This is an English translation provided for convenience. In case of any discrepancy, the Spanish version prevails.
In short
- These are the companies that process personal data for OpenWAF Cloud: Hetzner (Germany), Vultr (Madrid, Spain), Cloudflare (USA) and Let’s Encrypt (USA).
- Customer data are stored in the European Union. Transfers outside the EEA rely on the EU Standard Contractual Clauses.
- We tell customers by e-mail at least 30 days before adding or replacing a sub-processor, as set out in section 6 of the Data Processing Agreement.
1. Sub-processors
AI Services LLC (OpenWAF) uses the following sub-processors to provide OpenWAF Cloud. The same list is Annex III of the Data Processing Agreement; the Privacy Policy explains what they process when we act as controller.
| Sub-processor | Location of processing | Purpose | Customer data processed |
|---|---|---|---|
| Hetzner Online GmbH (Germany) | Germany (EU) | Hosting: control plane, databases, DNS servers, edge nodes, mail server and backup storage. | All service data: configuration, account data, security events, access-gate e-mail addresses, traffic through the German edge nodes and backups. |
| The Constant Company, LLC (Vultr) (USA) | Madrid, Spain (EU) | Hosting of the Madrid edge node, which serves visitors in Spain. | Traffic of the visitors routed to that node (TLS termination, WAF, cache) and the configuration the node needs. |
| Cloudflare, Inc. (USA) | USA and Cloudflare’s global network | Registrar and DNS of openwaf.dev, and network proxy in front of this website, the dashboard, the control-plane endpoint our edge nodes use, and the AI egress endpoint. | IP addresses and the content of those connections in transit, including configuration documents (which may contain access-gate e-mail addresses and certificate private keys) and, if AI egress is enabled, the requests of the customer’s AI agents. |
| Internet Security Research Group (Let’s Encrypt) (USA) | USA | Issuing TLS certificates. | Hostnames only. |
2. Providers that are not sub-processors
- Our own mail server. Sign-in and access-gate e-mails are sent from a mail server we operate ourselves on Hetzner in Germany; no third-party e-mail service is used.
- Google LLC and GitHub, Inc. (sign-in). If a user chooses to sign in with Google or GitHub, that provider acts as an independent controller of the sign-in.
- GitHub, Inc. (source code). We keep our source code on GitHub. It contains no customer personal data.
- AI model providers (AI egress). Providers such as OpenRouter, OpenAI or Anthropic receive requests only when a customer enables AI egress, chooses them as targets and stores its own API key for them. They act under the customer’s own agreement with them, not as our sub-processors.
- Customers’ origin servers and hosting providers. We forward allowed requests to the origins the customer configures.
3. Transfers
Where a sub-processor processes customer data outside the European Economic Area, or AI Services LLC accesses it from the United States, the transfer relies on the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914 and, for UK data, the UK International Data Transfer Addendum, as set out in section 9 of the Data Processing Agreement. We do not rely on the EU–US Data Privacy Framework.
4. Changes to this list
We will tell the owners of each customer account by e-mail at least 30 days before adding or replacing a sub-processor, and update this page. Customers can object as described in section 6 of the Data Processing Agreement. Questions: [email protected].