# Sub-processors

> The providers that may process data on our behalf to run OnlyText, so you can check them before you sign.

_Last updated: Sep 6, 2026_

## Why this page exists

We do not run every part of OnlyText ourselves. Hosting, transactional email, payments and uptime monitoring come from providers who, in doing that work, may process personal data on our behalf. Art. 28 GDPR calls them sub-processors, and it requires us to be able to name them. If you are assessing OnlyText for procurement, this is the list to review.

Each provider is bound by a data processing agreement with obligations no weaker than the ones we owe you, and each is used only for the purpose stated below.

## Current sub-processors

| Provider | Purpose | Location | Data reaching it |
| --- | --- | --- | --- |
| UpCloud | Application hosting, database and object storage | Germany (EU) | All service data, including account data and customer documents |
| Brevo | Transactional email — verification, password reset, invitations | France (EU) | Name, email address and message content |
| Stripe | Payment processing and subscription billing | Ireland (EU) and United States | Billing contact, payment method and transaction data |

## Where processing happens

Application data and customer documents are stored in the European Union. The one provider above with processing outside the EU is Stripe: card and transaction data may be transferred to the United States, covered by the European Commission's standard contractual clauses and Stripe's certification under the EU–US Data Privacy Framework. No customer document ever reaches Stripe.

## Document processing

Documents are converted, extracted and indexed on our own infrastructure. Detection of personal data before publication runs there too, using a local model — a document is not sent to a third party to be checked. If we ever introduce an external service that processes customer documents, it will appear in the table above under the notice period below, before it starts.

## Notice of changes

We give at least 15 days' notice before a new sub-processor starts processing personal data, by email to account holders and by updating this page. If you object on reasonable data protection grounds within that period, we will work with you to find an alternative; if none is workable, you may terminate the affected part of the service without penalty.

To be notified of changes, or to request the data processing agreement, write to privacy@onlytext.tech.