Sub-processors
A sub-processor is a third party that processes data on our behalf in order to run palumb. This page lists every one of them, including, for each, the company that ultimately owns it. That last column is the point: it is the difference between data sitting in Europe and data governed by Europe.
Last updated:
| Sub-processor | Purpose | Where | Owned by |
|---|---|---|---|
| Scaleway SAS | Cloud hosting: compute, managed PostgreSQL and secret storage (the platform, the durable runtime and your data). | France | Iliad SA, France |
| Scaleway Transactional Email | Palumb's own operational and account email: beta invitations, service notices. Not your notifications, which go through your provider. | France | Iliad SA, France |
| BunnyWay d.o.o. (bunny.net) | Static hosting and CDN for palumb.com. Serves the pages you are reading; no notification data passes through it. | Slovenia · EU edge network | BunnyWay d.o.o., Slovenia |
| IONOS SE | Domain registration and the business mailboxes behind our @palumb.com addresses. | Germany | United Internet Group, Germany |
| Bugsink B.V. | Error monitoring and crash reporting for the Palumb platform. | Netherlands · hosted in the EU | Bugsink B.V., Utrecht, Netherlands |
| Creem (Armitage Labs OÜ) | Payments and subscription billing, as merchant of record. Handles card data so Palumb never does. | Estonia | Armitage Labs OÜ, Tallinn, Estonia |
| Simple Analytics B.V. | Cookieless analytics for palumb.com: aggregate page counts, never your notification data. | Netherlands | Simple Analytics B.V., Netherlands |
| Phare (phare.io) | Public status page, uptime monitoring and incident communication. | Germany | Phare, Estonia |
| Brevo (Sendinblue SAS) | Holds the waitlist (your email and whatever optional detail you add), and sends you the beta invitation if we get to you. | France · Belgium | Sendinblue SAS, Paris, France |
| Formward (EGF Fastighetsservice AB) | Receives the contact form on our contact page: your name, your email and your message, and nothing else. | Sweden | EGF Fastighetsservice AB, Stockholm, Sweden |
Choosing these suppliers meant looking, where we could, at who they rely on. That second level is not on this page: it is governed by our contract with each supplier rather than by our list, and a table cell carries no date for a fact that changes without us. It is written up, with the sources and the day each one was checked, in Sovereignty is recursive, including the one leg of this chain whose second level is mixed.
How a supplier gets onto this page
Three questions, in this order. A supplier has to pass all three.
Is the company established in the EU?
Incorporated and operating here, so EU law is the law that applies to it.
Whose infrastructure does it run on?
We follow the chain to the machines wherever it is published, and it weighs as much as the first question: incorporation and hosting have to point the same way.
Can we name the whole chain in public?
If we cannot write down who ultimately owns a supplier, we do not use it.
Changes to this list
We post changes here, and we announce new sub-processors to customers under a data processing agreement in advance, so there is time to object before anything moves.
Questions about any entry (or a correction, if you know something about one of these companies that we do not) go to privacy@palumb.com.
Everyone who joins gets in, and it costs nothing. Your invite goes out when the beta opens.
Join the beta