Sub-processors — Agent Armory
Version: 2026-07-03
This page lists the third-party service providers that Agent Armory uses to deliver the Service. It is published as required by Articles 13–14 and 28 GDPR and as part of our commitments to Enterprise customers.
We notify Enterprise customers at least 30 days in advance by email before a new sub-processor that processes personal data begins that processing (Section 17 of the Terms of Service). Sub-processors that handle no personal data are listed here for transparency and do not trigger that notice.
| Sub-processor | Role | Data categories | Region | Transfer mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting (VPS + storage) | All Service data | EU (Germany / Finland) | EEA — no transfer |
| Stripe Payments Europe Ltd | Subscription billing | Email, name, billing address, Stripe customer ID, subscription metadata | Ireland (EEA) + US support | Stripe DPA + SCCs + DPF |
| Resend | Transactional email (login codes) | Email address, login code, send timestamp | Ireland (eu-west-1) | SCCs + DPF |
| Google LLC (Gemini API) | Text embeddings for search | Search queries; public catalogue text | US | Google Cloud DPA + SCCs + DPF |
| GitHub Inc. | Pulls public source files for the catalogue | None — outbound only, no personal data sent | US | Not applicable (no personal data) |
| Cloudflare, Inc. | Domain registrar + authoritative DNS | None — DNS resolution only; no personal data processed | US (anycast) | Not applicable (no personal data) |
| Plausible Insights OÜ | Privacy-friendly, cookieless website analytics | Aggregate page views, referrer, browser/OS, approximate country (derived from IP; IP not stored) | EU (Germany) | EEA — no transfer |
Notes
- Stripe is an independent controller for payment-instrument data (card numbers, fraud signals) under its own legal basis; it is our processor for the subscription metadata we push to it.
- Resend is engaged exclusively for the login-code flow; we do not use Resend for marketing.
- Google Gemini receives only search queries and public catalogue text. Private and organisation Skills are not sent to Gemini. If we decide to enable embedding of private or organisation Skills, we will notify affected users in advance.
Change history
| Date | Change |
|---|---|
| 2026-05-19 | Initial publication. |
| 2026-07-01 | Added Plausible Analytics (cookieless website analytics). |
| 2026-07-03 | Confirmed Cloudflare (domain registrar + authoritative DNS, no personal data); scoped the sub-processor notice to processors of personal data. |