Sub-processors
The third parties that process customer personal data on our behalf, with their purpose and processing region. We notify customers in writing at least 30 days before adding or replacing a sub-processor. Three entries are conditional: payment through Stripe, AI generation and SMS process nothing on a deployment where they are not configured.
Last reviewed 2026-11-14
| Sub-processor | Purpose | Region | DPA |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of the application, the database and file storage | Germany (EU) | View |
| Cloudflare | Edge CDN, DDoS mitigation, WAF | Global edge | View |
| Closepact's own mail server (at Hetzner) | Transactional email: signing invitations, reminders, invoice delivery | Germany (EU) | — |
| OpenStreetMap Foundation (Nominatim) | Coordinates for a service address when somebody in the panel presses Fetch from address. Only street, postcode, city and country are sent, no name | United Kingdom | — |
| Stripe | Billing and payment of Closepact's subscriptions. Processes nothing until payment through Stripe is switched on | United States and Ireland | View |
| OpenAI | AI generation for the Pro tier of Offert & e-signering. Processes nothing unless a provider is configured | United States | View |
| Twilio / 46elks | SMS notifications, reminders and one-time codes, through whichever of the two is configured. Neither processes anything unless SMS is configured | United States (Twilio), Sweden (46elks) | View |
Other services (independent controllers)
Google is used only for sign-in, when the user chooses to sign in with Google.
What is not on this list
Amazon Web Services, Amazon SES and Postmark were listed here before. The application and the email run at Hetzner, and none of the three receives anything. Sentry and Anthropic have been removed as well: Sentry is not part of the application and no AI provider but OpenAI is wired in, so neither processed anything. A sub-processor that processes nothing does not belong on a disclosure.
Notification policy
We notify our customers by email at least 30 days before any new sub-processor begins processing personal data. Any customer may object in writing during that window; we will work with you to find an acceptable alternative or, failing that, allow termination of the affected part of the service.
Questions
Email legal@closepact.com or privacy@closepact.com.