Safan uses the following third-party service providers (sub-processors) to operate the platform. All primary data (database, uploaded files, backups) is stored within the European Union.
In accordance with Article 28 GDPR and our Data Processing Agreement, we will notify all church administrators by email at least 30 days before adding or replacing a sub-processor.
| Sub-processor | Purpose | Data processed | Location | Safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting (VPS, database, application servers) | All platform data | Germany (Falkenstein / Nuremberg) | EU — DPA |
| Cloudflare, Inc. | CDN, DNS, bot protection (Turnstile), object storage (R2) | IP addresses (CDN); uploaded files and backups (R2, EU jurisdiction) | Global network; R2 EU jurisdiction | SCCs + DPF — DPA |
| Brevo (Sendinblue) | Transactional email delivery | Email address, first/last name, email content | France | EU — DPA |
| Stripe Payments Europe, Ltd. | Payment processing | Billing email, payment card (tokenised), invoice data | Ireland (EU) | EU — DPA |
| Sentry (Functional Software, Inc.) | Error tracking and monitoring | IP address (hashed), user-agent, stack traces (may contain IDs) | EU region (Frankfurt, Germany) | SCCs + EU region — DPA |
Change Notification
We will notify all registered church administrators by email at least 30 days before adding a new sub-processor or replacing an existing one. If you object to a change, you may terminate your subscription before the new sub-processor begins processing your data.
Questions
For questions about our sub-processors, please contact contact@safan.app.