Annex B to the DPA: Sub-processors
Informational translation. Only the German version is legally binding.
As of: November 2026. Provider: ELEVAYTE Online UG (haftungsbeschränkt), Rüdigerstraße 16, 40472 Düsseldorf, Local Court (Amtsgericht) Düsseldorf HRB 110380, [email protected].
Related documents: Terms · Right of withdrawal · Fair use policy · Data processing agreement (DPA) · Open-source licences
As of: November 2026. The current list is available at piport.io/subprocessors. The first tier is the Operator ELEVAYTE Systems UG (first row); it engages the other providers.
| Provider | Service | Data | Location | Basis for third country |
|---|---|---|---|---|
| ELEVAYTE Systems UG (haftungsbeschränkt), Rüdigerstraße 16, 40472 Düsseldorf (Operator) | Service provider for hosting and operation of the Service: software, hosting via the following providers, relay, support, error analysis | all categories under § 2 | Germany | not applicable; agreement under Art. 28(4) GDPR with ELEVAYTE Online UG |
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen | Data centre and servers for API, dashboard, relay, Redis, logs | all categories under § 2 | Germany | not applicable |
| MongoDB Limited (MongoDB Atlas), Building Two, Number One Ballsbridge, Dublin 4, D04 Y3X9, Ireland | Managed database (MongoDB Atlas) for all stored service data; Microsoft Azure data centres as MongoDB's sub-processor | all categories under § 2 | Germany (Azure region Frankfurt am Main) | storage in the EU; insofar as the parent company MongoDB, Inc. (USA) obtains access, for example in support, EU-US Data Privacy Framework and standard contractual clauses |
| Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA | DNS for all hosts; proxy, TLS and attack protection for website, dashboard and API; delivery of the agent packages (Cloudflare R2). Relay and tunnel hosts DNS only, connections do not run via Cloudflare | IP addresses, requested addresses, browser details of dashboard and API users; no relay connections | worldwide, including USA | EU-US Data Privacy Framework, standard contractual clauses |
| Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA | Sending emails (invitations, notifications, account emails) | name, email address, content of the email, delivery data | USA | EU-US Data Privacy Framework, standard contractual clauses |
| Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA | Error monitoring | error reports with internal IDs, address, browser; cleaned of passwords, tokens, cookies | EU | insofar as data reaches the USA, EU-US Data Privacy Framework and standard contractual clauses |
Redis is self-hosted in the cluster at Hetzner; no further provider is involved for it.
Not sub-processors within the meaning of this DPA:
- Stripe (Stripe Payments Europe, Limited, Dublin, Ireland): Payment processing is processing under PiPort's own responsibility (contract handling) and that of Stripe as an independent controller. Stripe receives the Customer's billing data, but no device or usage data.
- Plausible: Plausible is self-hosted (stats.elevayte.systems) and measures, without cookies, only visits to the website piport.io, under PiPort's own responsibility; no external provider is involved.
- Monitoring (Grafana, Prometheus, Loki, Tempo): is operated in our own cluster; no external provider is involved.