Sub-processors

Effective 2026-09-16. This list is dated so that a change to it is visible rather than announced.

These are the providers that process personal data on our behalf. Everything else Victano reads is public procurement data, which involves no processor.

Provider	What it does	Where it runs	Outside the EEA
Hetzner Online GmbH	Hosting. The application, the corpus and the account database run on one virtual machine	Germany	No
Cloudflare, Inc.	DNS and TLS termination in front of the site and the MCP endpoint	Global edge, EU-first routing	Yes, standard contractual clauses
Resend (Plus Five Five, Inc.)	Sends sign-in codes, deletion confirmations and account email	United States	Yes, standard contractual clauses
Functional Software, Inc. (Sentry)	Receives application errors so faults are found before customers report them	United States	Yes, standard contractual clauses
Google Ireland Limited	Google Analytics 4, and only for visitors who opt in	EU and United States	Yes, standard contractual clauses
Umami, self-hosted by the operator	Cookie-free page counting. Runs on estate infrastructure, not a third party	Germany	No

What is deliberately absent

There is no CRM, no advertising network, no data enrichment provider, and no marketing automation platform. Personal data is not sent anywhere except to run the service.

Changes

We will add a provider to this list before it starts processing, not after. Material changes are recorded on the changelog with a date.