Sub-processors
Every third party that processes data on our behalf, where it sits, and how changes are announced.
Version 2026-09-03 · effective
1The list
These are the third parties that process your fleet’s data on our behalf so that Photon Now can run. This page is part of our Data Processing Agreement and is the authoritative list.
| Provider | What it does for us | Where | Transfer basis |
|---|---|---|---|
| OVHcloud OVH SAS, Roubaix, France | Hosts our servers, the database and the tunnel gateway that carries remote-session traffic. Most of your data lives here and nowhere else. | EU data centres | Hosted in the EU. OVHcloud's own sub-processors are listed in its data processing agreement. |
| Cloudflare Cloudflare, Inc., San Francisco, United States | Fronts photonnow.com as a TLS proxy and content delivery network, so it sees the network address of every visitor and the pages they request. It also provides the object storage that holds the files you publish, which your devices fetch from it directly. | United States; object storage on Cloudflare's global network | EU Standard Contractual Clauses |
| GitLab GitLab Inc., San Francisco, United States | Serves this site and the dashboard as static files. Its access logs see a visitor's network address and the URLs they open. It never sees your fleet's data. | United States | EU Standard Contractual Clauses |
| Resend Resend, Inc., San Francisco, United States | Sends our email: address verification, password resets, invitations, purchase confirmations and the alert notifications you configure. It processes the recipient address and the message, which for an alert includes the device or run name and the alert text. | United States | EU Standard Contractual Clauses |
| Stripe Stripe Payments Europe, Limited, Dublin, Ireland, with Stripe, Inc., United States | Takes payment and issues invoices. It holds your organisation's name, the billing email address, your subscription and invoice history, and the payment details, which never reach us. | Ireland (EU), with support from the United States | EU Standard Contractual Clauses |
For each provider outside the EEA we rely on the European Commission’s Standard Contractual Clauses, incorporated in that provider’s data processing terms. We do not currently rely on the EU–US Data Privacy Framework for any of them.
Stripe is an independent controller for the payment itself — card data, fraud screening and the checks the law requires of a payment institution — and a processor for the rest. Stripe’s own privacy policy governs the data it holds as controller.
2Who is not on it, and why
Providers that only ever handle our own data about you — the mail provider behind our contact addresses, the avatar service the dashboard fetches profile pictures from, and any usage-analytics provider — never touch your fleet’s data. They are named in the Privacy Policy, sections 5 to 7, rather than here.
Our database is OVHcloud’s managed MongoDB service, operated by OVHcloud in the EU, so the database software’s vendor is not a party we contract with. OVHcloud’s own sub-processors, if any, are listed in its data processing agreement.
3How changes are announced
Before a new or replacement sub-processor starts processing your data, we email your organisation administrators at least 30 days beforehand and update this page. If we have to replace a sub-processor urgently to keep the service secure or available, we tell you as soon as reasonably practicable instead, and you keep the same right to object.
This list names the providers we contract with directly. Each of them uses sub-processors of its own under its published list; when one of them announces a change we pass the notice on as soon as we receive it, and the same right to object applies.
If you have a reasonable data-protection objection, reply within those 30 days. If we cannot resolve it, you may terminate the affected part of the service and we will refund the unused part of what you have prepaid — for a subscription, the days after termination; for a data top-up, the data you have not drawn. The same commitment is made in section 5 of the DPA.
Questions: hello@photonnow.com.