Subprocessors

A subprocessor is a company we use that touches your data in the course of running Kern Cloud. This is all of them. If you self-host Kern, this page does not apply to you: a self-hosted instance has no telemetry, no licence check and no route back to us, so the only processors are the ones you choose yourself.

The list

Hetzner Online GmbH — Servers and the database

Everything in your workspace, because the application and its Postgres database run on their machines.

Where: Nuremberg, Germany (nbg1)

Hetzner Online GmbH — Object storage

Every file uploaded to a workspace — attachments, avatars, documents.

Where: Nuremberg, Germany (nbg1)

Stripe Payments Europe, Ltd. — Payments

Billing contact, company name, tax address and seat count. Card details go to Stripe directly and never reach us.

Where: Ireland, with transfers to the United States under standard contractual clauses

Cloudflare, Inc. — Network edge, DNS and our own mailboxes

Every request to kernaio.com and app.kernaio.com passes through their network, so they see the request metadata and its contents in transit (encrypted end to end to us). Mail sent to our hello@, support@, security@, privacy@ and sales@ addresses is forwarded by them. File uploads and downloads go to Hetzner directly and do not pass through Cloudflare.

Where: Global edge network; a United States company, under standard contractual clauses and its EU data-processing terms

Where your data sits

In Germany. The application, the database and the files are all in Hetzner’s Nuremberg region. Two things leave it: payment data, to Stripe, because that is what taking a card requires; and every request in transit, which reaches us through Cloudflare’s edge. That is the whole of it.

Email delivery, and why nobody is listed for it

Kern Cloud does not send email yet. There is no relay configured and no delivery account anywhere, so no message — no invitation, no password reset, nothing a workspace sends — has ever left the instance. A delivery provider would be a subprocessor, and a serious one: it would receive the address and the contents of every email Kern sends for you. So it is not listed here in advance of existing. When we buy one it is named on this page, and account administrators are told, before it carries its first message. Kern Cloud says the same thing where somebody choosing a plan will read it.

When this changes

We tell account administrators by email before a new subprocessor starts processing anything, and this page changes on the same day. If you object to one, write to [email protected] and we will tell you what your options are before it happens rather than after.

Data processing agreements

We do not yet publish a data-processing agreement of our own for you to sign. If your company needs one before it can use Kern Cloud, write to [email protected] and we will deal with it directly. Saying that plainly seemed better than pointing at a document that is not written.