Itnetic TechnologiesSub-processors
Itnetic Technologies
Last updated: 31 July 2026
This is the authoritative list of the sub-processors Itnetic engages. It is referenced by Annex A of the Privacy Policy and Annex III of the Data Processing Addendum, and the three are kept identical.
Under the DPA, customers receive at least 30 days' notice before we add or replace a sub-processor, and may object on reasonable data-protection grounds.
1. Current sub-processors
| Sub-processor | Role | Touches End-User traffic data? | Location | Transfer mechanism |
|---|---|---|---|---|
| OVHcloud (OVH SAS) | Volumetric DDoS absorption; servers running the edge network and the control plane | Yes | EU (France) | N/A — EU |
| Railway Corp. | Hosting for the dashboard, the marketing website and our self-hosted analytics instance | No — customer-account data only | Data stored in the EU region; provider is US-incorporated | SCCs |
| Stripe Payments Europe, Ltd. | Payment processing, billing, payment fraud prevention | No — customer-account and billing data only | EU / USA | SCCs |
| Seznam.cz, a.s. (Seznam Profi e-mail) | Account, verification, support and alert email | No — customer-account data only | Czech Republic (EU) | N/A — EU |
| Cloudflare, Inc. | Turnstile bot check on Itnetic's own sign-in and sign-up forms | No — customer-account data only | USA | SCCs |
Only OVHcloud processes end-user traffic data, and it does so inside the EU. Everything a visitor to a protected site sends us stays on EU infrastructure.
2. Deliberately not sub-processors
| Party | Why not |
|---|---|
| Umami (analytics) | Self-hosted by Itnetic at a.itnetic.com on Railway's EU region. No analytics vendor receives any data. |
| DB-IP (IP geolocation) | We download the free "lite" databases monthly and query them on our own servers. No visitor data is ever sent to DB-IP. |
| Discord, Inc. | Only reachable if you enable a Discord webhook for attack alerts and supply the URL. That is a transfer you direct to a recipient you chose — see DPA Section 6. Alert payloads contain the hostname and aggregate traffic counts, never visitor IP addresses. |
| Your alert email address | Same reasoning: you choose the destination. |
| Your origin, your DNS provider, your object storage | Your own infrastructure, under your own contracts. |
3. Where data is processed
| Data | Where |
|---|---|
| End-user traffic passing through the edge (IPs, request metadata, security signals) | EU only (OVHcloud, France + EU points of presence) |
| Request logs and analytics rollups | EU only (control-plane database) |
| Customer account, domains, configuration | EU region (Railway) |
| Billing | Stripe (EU entity; group processing may reach the USA under SCCs) |
| Email delivery | EU only (Seznam.cz) |
| Sign-in bot check | Cloudflare (USA, under SCCs) — only the sign-in page, never a protected site's visitors |
4. Changes and notification
We publish changes on this page. Material changes are notified to customers by email at least 30 days before the new sub-processor begins processing, as required by Section 6 of the DPA.
Questions or objections: chlibekbusiness@gmail.com.