Sub-processors
Datlay is not open yet. This is version 1 of this list, published ahead of the launch in 2027. It applies from the day a company first accepts the DPA, in the beta or after launch. Until then no customer data is processed at all: only this website (on a Hetzner server) and our mail (in Google Workspace) are running.
Datlay is operated by Rteam FZE LLC. These are the companies that process customer data for Datlay as our sub-processors, as section 6 of the Data Processing Agreement describes. No AI provider is among them: Datlay itself sends customer data to no AI provider of ours.
The list of 5 November 2026
| Company | What it does for Datlay | Where the data is | Customer data in the service |
|---|---|---|---|
| Hetzner Online GmbH, Germany | Servers for the workspaces and a nightly encrypted backup copy. Also the server of this website. | Germany | Yes: everything in the workspaces |
| Backblaze, Inc., United States | Storage of the continuous backups of the workspaces (Backblaze B2) | Backblaze's EU Central region: Amsterdam, the Netherlands | Encrypted copies only. They are encrypted before they leave our servers, with a key Backblaze does not hold. |
| Google Cloud EMEA Limited, Ireland (Google Workspace) | The email we send and receive, including support@datlay.com, security@datlay.com and the service's emails to your users | Google's data centres worldwide, including in the United States | What you send us by email, and the recipients and content of the service's emails |
| Plus Five Five, Inc., United States (Resend) | Backup sender of the service's emails, and sender of our monitoring alerts | United States | The recipients and content of the emails it sends |
Notes on the list
- Transfers. Hetzner keeps the data in Germany. Backblaze, Google and Resend can process data outside the EEA. Each of them does so under an adequacy decision (including the EU-US Data Privacy Framework where the recipient is certified) or the EU standard contractual clauses, as section 11.4 of the DPA requires.
- Backblaze holds encrypted copies only and cannot read them. Each workspace's backups have their own key, and destroying every copy of that key at the end makes them unreadable at once.
- Resend is the service of Plus Five Five, Inc. Its data processing agreement says that its primary processing takes place in the United States.
Other providers (billing, not customer data)
| Company | What it does for Datlay | Where the data is | Customer data in the service |
|---|---|---|---|
| Stripe Payments Europe, Limited, Ireland | Payments, subscriptions and invoices | Stripe's systems, including in the United States | None: only the billing data of your company's account |
Stripe never receives the data in your workspace, so it is not a sub-processor under the DPA. It processes the billing data of your company's account, for which we are the controller (see Privacy), partly on our behalf and partly as a controller in its own right, for example to prevent fraud and to meet its legal duties, as section 2 of its Data Processing Agreement says. Card and bank details are typed into Stripe's own pages and never reach our servers.
Who is not a sub-processor
- The vendors of your connected systems (for example Odoo, HubSpot, Intuit for QuickBooks Online, and Microsoft for Business Central). They work for you under your own contracts with them. Your data stays in their systems as before.
- The provider of your own AI assistant (for example Claude or ChatGPT). You choose it, and it acts as your processor under your own terms with it, as section 13 of the DPA says.
How a change is announced
At least 30 days before a new or replacing sub-processor starts to process customer personal data, we email the administrators of every workspace and update this page with the date the change takes effect. Your company may object within 10 business days of our notice, as section 6.3 of the DPA describes.
Changes to this list
- 5 November 2026
- First list, version 1.