Current sub-processors
Version 1.0. Effective 5 August 2026. This list is incorporated by reference into the FastComments Data Processing Agreement. We give at least 30 days' notice before a new sub-processor begins processing customer personal data, by email to the account administrator and by publication on this page. No subscription is required to receive that notice. Customers may object on reasonable data protection grounds within 30 days, as set out in section 8 of the Data Processing Agreement.
The "Region" column states whether a sub-processor serves accounts created on eu.fastcomments.com, accounts created on fastcomments.com, or both.
| Sub-processor | Processing activity | Location of processing | Region |
|---|---|---|---|
| Hetzner Online GmbH Industriestr. 25, 91710 Gunzenhausen, Germany |
Hosting of application and database servers. Hetzner Finland Oy, Huurrekuja 10, 04360 Tuusula, Finland, is engaged by Hetzner Online GmbH for building rental and technical support at the Finnish site. | Falkenstein, Germany. Tuusula, Finland. | Both |
| OVH SAS 2 rue Kellermann, 59100 Roubaix, France |
Hosting of application and database servers. | Gravelines, France | European Union |
| OVH GmbH Oskar-Jäger-Str. 173/K6, 50825 Köln, Germany |
Hosting of application and database servers. | Limburg an der Lahn, Germany | European Union |
| OVH US LLC 11950 Democracy Drive, Suite 300, Reston, VA 20190, United States |
Hosting of application and database servers. | Hillsboro, Oregon and Vint Hill, Virginia, United States | Global |
| BrainStorm Network, Inc., trading as OneProvider 3275 Av Francis-Hughes, Laval, QC H7L 5A5, Canada |
Hosting of application and database servers. OneProvider resells capacity operated by third parties at this location. | São Paulo, Brazil | Global |
| Wasabi Technologies LLC 75 Arlington Street, Suite 810, Boston, MA 02116, United States |
Object storage of encrypted periodic backup copies. | Frankfurt, Germany for European Union region backups. Oregon, United States for global region backups. | Both |
| Akamai Technologies, Inc. 145 Broadway, Cambridge, MA 02142, United States |
Delivery of outbound webhook events to endpoints nominated by the customer. | United States | Both |
| Deep Infra, Inc. 2625 Middlefield Road #460, Palo Alto, CA 94306, United States |
Automated spam classification, image content moderation, and the moderation agent and assistant features. Engaged only where the customer enables one or more of those features, which are off by default. | United States | Both, where enabled |
| Mailgun Technologies, Inc. 112 E Pecan Street #1135, San Antonio, TX 78205, United States |
Delivery of notification and transactional email to end users and administrators. | United States or the European Union, according to the region selected for delivery | Both |
| SIB INC. US, trading as Brevo 2140 South Dupont Highway, Camden, DE 19934, United States, part of the group headed by Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France |
Delivery of notification and transactional email to end users and administrators. | France and Belgium | Both |
Contractual status
Each sub-processor above is engaged under a written contract incorporating that provider's data processing terms, with two exceptions, stated here so that customers can assess them.
Deep Infra, Inc. does not publish a data processing agreement or standard contractual clauses, and no such contract is in place at the effective date of this list. We are pursuing one. This sub-processor is engaged only where a customer enables the automated spam classification, image content moderation, moderation agent or assistant features, which are off by default. Where those features are not enabled, no customer personal data is disclosed to this sub-processor at any time, and a customer may disable them at any time without charge. The provider's published terms state that data submitted to its interfaces is not stored, sold or used to train models. The models used by the service run on that provider's own infrastructure and no data is passed through to any further model vendor.
BrainStorm Network, Inc. does not publish a data processing agreement, and no such contract is in place at the effective date of this list. We are pursuing one. This sub-processor hosts servers in the global region only, and processes no personal data belonging to a European Union region account at any time.
Vendors that do not process customer personal data
Stripe, LLC, Corporation Trust Center, 1209 Orange Street, Wilmington, DE 19801, United States, processes billing and payment data relating to our own customers. That is account data, for which WinrickLabs LLC acts as an independent controller under our Privacy Policy, so Stripe is not a sub-processor under the Data Processing Agreement. Payment card details are collected and processed directly by Stripe and are not stored by WinrickLabs LLC.
Services we operate ourselves
Content delivery, application logging, error reporting and support ticketing run on the infrastructure listed above. No third-party content delivery network, logging service, error tracking service, analytics service or support desk receives customer personal data.