Sub-processors
Outhentik Sub-processor List
This page lists the third-party service providers ("sub-processors") that Outhentik engages to provide the Outhentik platform, and, separately, the third parties a visitor's browser contacts directly.
All sub-processors are bound by data processing agreements consistent with Article 28 of the EU GDPR and UK GDPR. Outhentik remains fully responsible for the acts and omissions of its sub-processors.
Last updated: 6 October 2026 Version: 1.5
How sub-processors are selected
We select sub-processors based on:
- Demonstrable security posture (SOC 2 Type II, ISO 27001, or equivalent for major providers)
- GDPR compliance and ability to enter into Article 28-compliant data processing agreements
- Track record in the SaaS infrastructure market
- Alignment between the sub-processor's primary jurisdiction and our customers' data protection expectations
Current sub-processors
These providers may process personal data on Outhentik's behalf. The same list appears in our Privacy Policy, our Data Processing Agreement and our Technical and Organisational Measures, generated from one source.
| Provider | Purpose | Data involved | Region |
|---|---|---|---|
| Supabase Inc. | Database, sign-in and the server functions that run the platform | Account details; messages (typed text and transcripts); customer names, email addresses, phone numbers and ratings, where given; consent records; topic and issue analysis; support chat transcripts | Singapore (ap-southeast-1) |
| Cloudflare, Inc. (R2 storage) | Stores and serves voice and video files, thumbnails and logos | Voice and video files sent by customers; video thumbnails; business logos | European Union (Western Europe) |
| Vercel Inc. | Hosts the website and the app | IP address and request details of every visitor | United States, with a global edge network |
| Speechmatics Ltd | Turns voice and video messages into text | The audio of voice and video messages | European Union (EU1 processing region); United Kingdom (contracting entity) |
| Google LLC (Gemini API) | Reads message text to sort what customers say into topics and issues, and groups and merges those topics. Also writes replies in the Outhentik support chat | Typed message text and transcripts (never the voice or video file); topic labels and short quotes; support chat messages | Global, no regional commitment |
| Google LLC (Places API) | Finds a business's own Google listing, builds its Google review link, and reads that listing's public rating and reviews for the business's dashboard | The business's search text, name and Google place ID. No customer data | United States |
| OpenAI, L.L.C. | Support chat only. Turns a question typed into the Outhentik support chat into a numeric embedding, so the matching help article can be found. Never receives customer messages | The text of a support chat question | United States |
| Pinecone Systems, Inc. | Support chat only. Holds Outhentik's own help content and searches it. Never receives customer messages | The numeric embedding of a support chat question, not its text | United States |
| Resend Inc. | Sends email: account, team and alert emails to business users, and the single Google review invite email to customers who ask for one | Email addresses, names and email content; delivery and bounce events | United States |
| Paddle.com Market Ltd | Merchant of record: checkout, billing, tax and invoices | Billing name, email address and address; payment details, which Paddle holds and Outhentik never sees; transaction records | United Kingdom |
| Functional Software, Inc. (Sentry) | Error reports from the app | Account ID; page address, with share links removed; browser and device details; error details. No IP address or email address | European Union (Germany) |
| Seven Assets Ltd (UptimeRobot) | Checks from outside that the site is up | No personal data. It reads status responses only | Switzerland |
The security certifications these providers hold are listed in Section 6.2 of our Technical and Organisational Measures.
Third parties your browser contacts
These providers are not sent data by Outhentik's servers. Some pages ask the visitor's browser to load files from them directly, so they receive the visitor's IP address and browser details.
| Provider | Purpose | Data involved | Region |
|---|---|---|---|
| Google LLC (Google Fonts) | Serves the fonts used on every page | The visitor's IP address and browser details | Global |
| Paddle.com Market Ltd (Paddle.js) | Checkout script, loaded on every page so a plan can be bought from any page | The visitor's IP address and browser details; checkout details when a payment is made | United Kingdom, with a global network |
| Google LLC (Google Analytics 4) | Website analytics. Loaded only after the visitor accepts analytics in the cookie banner, and never on the Wall of Love, the embed or a shared finding page | A pseudonymous identifier, pages visited, browser and device details, approximate location derived from the IP address | United States |
| jsDelivr | In the dashboard only, when a business user downloads a video that has to be converted: delivers the video converter | The business user's IP address and browser details | Global |
Access from Saudi Arabia
Outhentik's authorised personnel access systems from Saudi Arabia for product operations, technical support and security administration. This access is governed by:
- The Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by the UK International Data Transfer Addendum (IDTA) where UK personal data is involved
- The technical and organisational measures described at outhentik.app/security, including encryption in transit and at rest, multi-factor authentication on infrastructure accounts, access controls and confidentiality obligations
- The principle of data minimisation: access is limited to the minimum necessary
Outhentik's compliance posture under EU GDPR and UK GDPR is independent of the country from which authorised personnel access systems.
International data transfer safeguards
Where a sub-processor is located outside the European Economic Area or the United Kingdom, the following safeguards apply:
- Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by the UK IDTA for UK personal data
- Adequacy decisions for transfers to the United Kingdom and Switzerland
- EU-US Data Privacy Framework where the receiving organisation is certified
- Supplementary technical and organisational measures including encryption, access controls and pseudonymisation where applicable
The legal basis for each transfer is set out in Section 2.1 of our Data Processing Agreement.
Notification of changes
We may engage new sub-processors or replace existing ones as our infrastructure evolves. When we do:
- Customers with a Data Processing Agreement are notified by email at least fourteen (14) days before the change takes effect
- This page is updated on the same day as that notice, and shows the change and the date it takes effect
- Customers may object to a new sub-processor on reasonable data protection grounds, in accordance with Section 6.3 of our Data Processing Agreement
To receive notifications of changes to this list, contact [email protected].
Questions
For questions about our sub-processors or data processing practices, contact us at [email protected].
This page is published at outhentik.app/sub-processors and forms a reference for our Privacy Policy and Data Processing Agreement.