1Current subprocessors
The table lists the processors used by the current TrustNet deployment. Each processor acts under a data processing agreement entered into before it handles personal data.
| Provider | Function | Data | Location | Transfer mechanism | DPA status |
|---|---|---|---|---|---|
| DigitalOcean | Cloud hosting (application and data droplets) and object storage (private files, pictures) | Service data, uploaded files, file metadata, backups | EU region (fra1) |
EU-region hosting/storage; DPA and, where applicable, SCCs | To be signed before production |
| Postale.io SAS | Transactional email delivery | Recipient address, message metadata | France (EU) | EEA — no third-country transfer | To be signed before the first production send |
| SMSLink / ASTINVEST COM SRL | SMS delivery for extra phone contacts | Phone number, message content where applicable | Romania (EU) | EEA — no third-country transfer | To be signed before the first production send |
| Twilio (optional adapter) | SMS delivery, only if enabled | Phone number, message content where applicable | United States | SCCs and/or the EU–US Data Privacy Framework before enabling | Not enabled in the MVP |
Ory Hydra, Ory Kratos, Vault, PostgreSQL, RabbitMQ and Redis are self-hosted components, not third-party subprocessors.
2Hosting and data residency
The service and its processors are hosted in the European Economic Area. The MVP does not require a third-country transfer for the processors listed above. If the optional Twilio adapter is enabled, a transfer mechanism is put in place first and this page is updated before it starts processing.
3Transfers
For an EEA processor, no transfer mechanism is needed beyond the DPA and the applicable EU law. For a processor outside the EEA, TrustNet uses an adequacy decision where one applies (including the EU–US Data Privacy Framework where the recipient is certified) or Standard Contractual Clauses, supported by a transfer impact assessment.
4Changes and notice
TrustNet updates this page before a new subprocessor starts processing. RP operators receive notice through the contact channel in their agreement and may object on reasonable data-protection grounds. A subscription mechanism is planned; until then, write to privacy@trustnet.app to be added to the notice list.
5Contact
Questions about subprocessors or transfers: privacy@trustnet.app. See also the DPA.