Subprocessor Annex
Version 2026-08-12. Effective 2026-08-12.
This is the complete list of third parties involved in processing personal data for merkleset. There are three. It is referenced by section 6 of the Privacy Policy and incorporated into the Data Processing Agreement as Annex II.
Values marked placeholder have not been verified yet and will be filled in before this annex is published as final. We would rather show you a visible gap than a confident guess.
1. The list
| Provider | Role | Personal data | Location | Transfer mechanism |
|---|---|---|---|---|
| DigitalOcean, LLC | Infrastructure hosting. A single virtual host runs the whole platform, including the self-hosted MinIO object storage that holds release artifacts and internal raw evidence | All service data at rest and in transit inside the host: account records, consent records, entitlements, application and web server logs | United States company. Datacentre region: {{HOSTING_REGION}} (placeholder — unverified) | Provider data processing agreement plus EU Standard Contractual Clauses: {{TRANSFER_MECHANISM}} (placeholder) |
| Stripe | Merchant of record for the purchase, plus payment processing, billing and invoicing, tax determination and remittance, fraud and dispute handling, and payment-related customer support. Contracting entity: {{STRIPE_CONTRACTING_ENTITY}} (placeholder) | Name, email address, billing address, tax identification number, transaction and payment metadata. Card data never reaches our systems | European Union and United States | Provider data processing agreement plus EU Standard Contractual Clauses: {{TRANSFER_MECHANISM}} (placeholder) |
| Mailgun (Sinch) | Transactional email: one-time login codes and contact form messages | Recipient email address, message content (a login code, or the contact form's name, company and message) | European Union — EU region confirmed. Mail is sent through the provider's EU relay | None required for the EU region |
We use no content delivery network, no analytics provider, no session recording, no advertising network, no customer support platform and no third-party script on the website.
2. Notes that matter for a procurement review
2.1 Stripe is not merely our processor. As merchant of record Stripe invoices you, collects and remits applicable taxes and handles payment disputes, determining its own purposes for that relationship. For billing data it therefore acts as an independent controller, and its own privacy notice governs it. We remain the controller for your account and your use of the service.
2.2 DigitalOcean is a United States company, and that matters regardless of datacentre region. A US-parent provider is capable of access, so we treat hosting as involving a potential transfer to the United States and rely on the provider's data processing agreement together with the Standard Contractual Clauses. We are not going to state a datacentre region as a fact until we have confirmed it from the provider's own console rather than inferred it.
2.3 Object storage is self-hosted. Release artifacts and internal raw evidence live in MinIO running on the same host, not in a third-party object storage service. So there is no additional storage provider on this list — the hosting provider is the storage provider.
2.4 Mailgun sees email addresses and message bodies. That is unavoidable for a service that authenticates by emailing a code. It is used in the EU region so that this data stays inside the European Economic Area.
2.5 No employees, no contractors with access. The service is operated by one individual. There is no support outsourcing, no offshore team and no third-party administrator.
3. Changes to this list
3.1 Adding or replacing a provider means publishing a new version of this annex.
3.2 Customers who have signed the Data Processing Agreement get at least 30 days' notice by email before a new subprocessor starts processing their data, and may object on data protection grounds under clause 5.3 of that agreement.
3.3 This annex is versioned by effective date, like every other document in this set.
4. Contact
Questions, or a request for a copy of a provider's data processing terms: privacy@merkleset.com.