Sub-processors

This page lists the third parties we engage to help deliver our services, and what each of them does. It is referenced by our Data Processing Agreement.

We give at least 30 days’ notice before adding or replacing a sub-processor that processes API request data. We do this by updating this page, and every change is recorded in the table at the foot of it. If you would like those changes sent to you by email as well, email support (at) thunderforest (dot) com and we will add you to the notification list.

Your data — and your users’ data — is shared only with the providers listed on this page, and only so that they can perform the services described. We do not sell it, rent it, or otherwise give it to anyone else.

Processing of API request data

These sub-processors process data contained in requests to our API, as described in Annex 1 of our Data Processing Agreement. This is the data we process on your behalf as your processor.

Sub-processor Location Purpose
Hetzner Online GmbH Germany Hosting of servers that deliver the Services, and central storage of request logs
DigitalOcean, LLC United States Hosting of servers that deliver the Services
Cloudflare, Inc. United States Authoritative DNS and latency-based traffic steering

Notes on this list:

  • Requests are steered by latency, not pinned to a single location. A request is normally served from whichever of our locations is closest to the user making it, so European users are normally served from Germany. This is a performance mechanism rather than a data residency guarantee: a request may be handled in the United States where the user is, or appears to be, closer to our US infrastructure.
  • Request logs are held centrally in Germany for 45 days. Where a request is handled in the United States, the copy written on that server is deleted after 7 days, so the durable copy is always the German one.
  • Cloudflare does not carry API request traffic, which connects directly to our servers. Cloudflare answers the DNS query that tells a client which of our locations to use, and in doing so may receive an approximate, truncated form of the user’s network address in order to judge which is closest. It does not see the requests themselves.
  • Transfers to the United States — to both DigitalOcean and Cloudflare — are made under Standard Contractual Clauses together with the UK International Data Transfer Addendum. DigitalOcean is additionally self-certified under the EU–U.S. Data Privacy Framework and its UK Extension, which provides a second, independent basis for that transfer.

Our Data Processing Agreement sets all of this out in full.

Service providers for account data

These providers process the information you give us when you register and pay for an account — your name, email address, billing address and tax details. In respect of that data we act as a controller rather than a processor, so strictly speaking these are our processors rather than sub-processors, and our processing is described in our Privacy Policy. We list them here for transparency; they are not covered by the Data Processing Agreement.

Provider Location Purpose
Salesforce, Inc. (Heroku) United States Hosting of our account management and billing system
Stripe, Inc. United States Payment card processing
Xero (UK) Ltd United States, Australia, New Zealand Bookkeeping and accounting
The Rocket Science Group LLC (Mandrill) United States Sending account notification emails
Help Scout PBC United States Managing customer support correspondence

Our website

Our public website is hosted by GitLab Inc. (United States), and we use Fathom Analytics (Conva Ventures Inc., Canada), a privacy-focused analytics service, to count visits. These process data about visitors to this website — such as IP addresses — rather than account data or API request data, and are likewise described in our Privacy Policy.

Changes to this list

Date Change
18 August 2026 Initial publication

Questions about this list? Please contact us.