Subprocessors
Last updated: 6 November 2026
When you use CloudOps, Devops Team SRL processes personal data on your behalf as a processor under the GDPR (Article 28). The third parties below help us provide the service and may process some of that data: they are our subprocessors, and each one processes it under a data processing agreement with us. Our Data Processing Agreement page explains the rest of the arrangement.
Everything else runs on infrastructure that Devops Team SRL operates itself in the European Union: the platform and your tenant environment, their databases and backups, sign-in, support chat, and our build and deployment systems. No third party is involved there, so none of it appears below.
Current subprocessors
| Subprocessor | What it does for us | Personal data involved | Where, and transfer safeguard | Since |
|---|---|---|---|---|
| Amazon Web Services (Amazon SES) | Sends the platform's email: invitations, account and onboarding notices, billing and payment notices, alert and marketplace notifications, product announcements, and quote requests forwarded to our team. | Recipient name and email address, and the content of each email. | United States (AWS region us-east-1). EU–US Data Privacy Framework and the AWS GDPR Data Processing Addendum, which includes the EU Standard Contractual Clauses. | April 2026 |
| Cloudflare | DNS, content delivery, and protection against DDoS and web attacks. All traffic to our public endpoints (website, consoles and APIs) passes through Cloudflare and its secure tunnel to our infrastructure. | IP addresses, request details such as URLs, headers and browser type, and the content of web traffic while it passes through Cloudflare's network. | Cloudflare's global network, including the United States. EU–US Data Privacy Framework and the EU Standard Contractual Clauses. | January 2026 |
| Stripe | Card payments and invoices, tax calculation (Stripe Tax), payouts to marketplace providers (Stripe Connect), and identity checks for high-value marketplace rentals (Stripe Identity). | Billing contact name, email and address, VAT number, card details (entered directly with Stripe, never stored on our servers) and transaction history; for marketplace providers, payout and business verification details; for identity checks, identity document data. | European Union (Ireland) and the United States. EU–US Data Privacy Framework and the EU Standard Contractual Clauses. | July 2026 |
Only if you order a managed dedicated server
Some ready-to-order dedicated servers on the marketplace are servers we rent from a datacentre operator and hand over to you. If you order one, the operator that hosts it becomes a subprocessor for that server only. Our infrastructure partners run data centres in:
- the European Union.
- the United Kingdom, covered by a European Commission adequacy decision.
- Canada, covered by a European Commission adequacy decision.
The operator hosts the server, and with it the data you put on it; we do not read its contents. Each offer shows the datacentre's location, and we tell you the operator's name on request and before we add or replace one. If you do not order such a server, no operator processes your data.
Other third parties (not subprocessors)
These receive some personal data, but we do not engage them to process your data for us: you choose them, or they act on their own account.
- Google sign-in — if you choose “Sign in with Google”, Google authenticates you and shares your name and email address with us. Google is responsible for your Google account as an independent controller.
- Google Fonts — the tenant console currently loads its typeface from Google's servers, so your browser sends its IP address and browser details to Google when the console opens.
- Marketplace providers — when you rent a server from an independent provider on the marketplace, that provider hosts it under the Marketplace Terms. You choose the provider; we do not engage them on your behalf.
- Integrations you set up — alert webhooks (for example Slack), alert email recipients, AI assistants connected to your MCP endpoint and other tools you connect receive the data you send them. You choose those recipients.
Changes to this list
Before a new subprocessor starts processing customer personal data, we update this page and email the owners of every organization at least 30 days in advance. The “Last updated” date above shows the latest change.
If you have a data-protection reason to object to a new subprocessor, write to [email protected] within those 30 days and we will work with you on a solution.
Questions
Write to [email protected]. Business customers can request our Data Processing Agreement.