Sub-Processors

Sub-Processors

Draft pending counsel review — not legal advice, not in force until approved by the owner

This register is generated from ops/docs/trust/DPA-subprocessors.md (§4) by tools/legal/sync-subprocessors.mjs: it is extracted from the source, not retyped. Reviewed by: (pending) · Reviewed on: (pending).

1. Register

Last reviewed 2026-10-20 in the source. A change gets a new date in the source and a row in its change log.

Last reviewed 2026-10-20. A change gets a new date here and a row in §5.

Subprocessor	Service	Location	Data	Contract status
Hetzner Online GmbH	hosting for tcp (availability zone fsn1-dc14, region eu-central, Falkenstein, Germany)	EU (Germany)	all service data at rest and in transit on the host	Action: Hetzner’s T&Cs require an order-processing contract to be concluded in the account; that is not confirmed yet. Hetzner states ISO/IEC 27001:2022 certification (SOCOTEC) for its data centres.
Cloudflare, Inc.	authoritative DNS for tcp.systems (DNS-only; the A records return the origin address, so traffic is not proxied)	US, global anycast	DNS query metadata, not request content	DPA incorporated by reference into the self-serve terms (Cloudflare’s published GDPR position); SCCs and the EU–US DPF for the transfer
Upstream inference providers	model inference behind the acumen router	mixed, including US	prompt and completion content, request metadata	Gap: more than 200 provider/plan series are visible in the router’s metrics; provider-level DPAs and terms are not yet catalogued. A customer-specific list can be produced on request and must be before a regulated deal.
Payment processor	billing	—	—	Unknown: no processor is confirmed in this pass. Add the row before invoicing a customer.

Self-hosted components are not separate subprocessors: maddy (mail), Prometheus and Grafana run on the Hetzner host and are covered by that row.

Self-hosted components are not separate subprocessors: maddy (mail), Prometheus and Grafana run on the Hetzner host and are covered by that row (source: ops/docs/trust/DPA-subprocessors.md §4).

2. Change log

Date	Change
2026-10-20	Register created. Hetzner, Cloudflare and the inference-provider category recorded; provider-level contracts and the Hetzner order-processing contract listed as open.
2026-10-20	Exact-match response cache disabled (ACUMEN_EXACT_CACHE=0) and its 134 stored response bodies purged. §2 corrected: the “in transit only” claim was untrue while the cache was on. Open action 3 closed.

(Source: ops/docs/trust/DPA-subprocessors.md §5.)

3. International transfers

Service data is stored in Germany. Where a sub-processor is in the US, the transfer relies on the EU Standard Contractual Clauses and, where the recipient is certified, the EU-US Data Privacy Framework. The DPF’s legal basis was under political review during 2026; the Commission’s published position is that it remains valid, but a transfer story that depends on the DPF alone is fragile. SCCs are therefore the primary mechanism, not the fallback (source: ops/docs/trust/DPA-subprocessors.md §6).

4. Open actions

Hetzner’s order-processing contract is not yet confirmed in the account; upstream inference providers are not yet catalogued at provider level (a customer-specific list can be produced on request and must be before a regulated deal); no payment processor is confirmed yet (source: ibid., §4 and §8). Contact: security@tcp.systems (source: ibid., §9).