Updated: 2026-07-12
Sub-processors
This page lists third parties that process customer personal data on Sylphx's behalf to deliver the platform. Customers receive 30 days' notice of material additions or replacements.
Definition
A sub-processor is a third party that processes customer personal data on Sylphx's behalf. This does not include third parties selected by a customer to front or operate their own app.
Active sub-processors
Hetzner Online GmbH
EU (DE)
- Service
- Bare-metal hosting (FSN1 datacenter, Falkenstein DE)
- Data processed
- All customer data at rest + in transit through the service runtime boundary
- Contract
- DPA executed; SOC 2 Type II inherited
Cloudflare, Inc.
Global edge
- Service
- Edge + DDoS protection for *.sylphx.com and *.api.sylphx.com
- Data processed
- Request metadata only — no customer data persists at the edge
- Contract
- DPA executed
Stripe, Inc.
US (with EU sub-processors per Stripe DPA)
- Service
- Billing + payment processing
- Data processed
- Cardholder data (Stripe is the controller); customer-of-Sylphx billing-contact metadata
- Contract
- DPA executed; PCI DSS Level 1 inherited
GitHub, Inc.
GitHub service regions
- Service
- Source-code hosting, GitHub App webhooks/API, and Actions control plane; execution uses Sylphx self-hosted CI Compute
- Data processed
- Sylphx-internal source and repository-event metadata — listed for completeness
- Contract
- Standard GitHub Enterprise terms
Pending / proposed
Sentry (Functional Software, Inc.)
Error-tracking sink for level >= error log lines
Wired but inactive; no DSN provisioned
Tempo / Loki / Mimir (Grafana Labs OSS — self-hosted)
Distributed tracing + log warehouse
Self-hosted, no third-party sub-processor relationship
Customer rights
- Request the current list of sub-processors at any time.
- Object to a new sub-processor within 30 days of notification.
- Request executed DPA evidence for a sub-processor under NDA.
Email [email protected] for notifications or requests. See also the security overview.