Subprocessors and Service Providers
Effective: 2026-07-30
DomScan uses the following providers to operate the service. The data listed is limited to what is needed for each purpose.
| Provider | Purpose | Data involved | Role |
|---|---|---|---|
| Hetzner | Hosts the Node application, PostgreSQL, Valkey and local object storage. | Account, API, batch, result and operational data needed to run DomScan. | Infrastructure processor, Germany and EU. |
| Cloudflare | DNS/CDN, security, Turnstile, email dispatch and routing, and R2 off-site backups. | Request metadata, Turnstile signals, email content and protected backup data as applicable. | Processor or independent service provider depending on the Cloudflare product, global. |
| Google OAuth, hosted fonts and optional Google Analytics 4. | OAuth identity data, browser network metadata for hosted fonts, and optional analytics data only after consent. | Service provider or independent controller depending on the Google service, global. | |
| Stripe | Payment processing. | Customer, payment and transaction data needed to complete and administer a purchase. | Payment service provider and independent controller for some payment, fraud and compliance activities, US and EU. |
| Cuentica | Accounting and invoice records. | Customer and transaction information needed for accounting records. | Accounting service provider, EU. |
| Telegram | Customer notifications and support. | Notification destination and message or support content when the feature is used. | Communications service provider, global. |
| Webshare | Proxy for some registry and certificate-transparency requests. | Domain or query data and request metadata needed to perform the request. | Proxy service provider, global. |
| ZeroBounce | Optional email-address deliverability verification. | The email address submitted to an email-verification request and request metadata. | Verification service provider, US and global. |
Public WHOIS, RDAP, DNS, certificate-transparency and related data sources may receive the query needed to answer a request. Depending on their role, those sources may operate as independent recipients rather than DomScan subprocessors.
Some providers may process data outside the EEA. Where required, DomScan uses an applicable lawful transfer mechanism. DomScan will update this list when providers or purposes materially change and provide advance notice where data protection law or an applicable DPA requires it.
Questions or objections: [email protected]