Sub-processors

Annex 2 to the Data Processing Agreement / Anlage 2 zum AVV

Last updated: 2026-10-01

This page lists the third parties OrgOps GmbH uses to run myvibecode.app, and states for each one whether it touches the data of the apps you host (where you are the controller and OrgOps is your processor) or only platform account data (where OrgOps is the controller, see the Privacy Policy).

1. Sub-processors for hosted apps and their databases

These providers process the source code, databases, backups and runtime data of your apps.

Hetzner Online GmbH

Address
Industriestr. 25, 91710 Gunzenhausen, Germany
Service
Cloud servers, block-storage volumes, private network and firewall, S3-compatible object storage
Purpose
Running the platform, the Kubernetes cluster your apps run in, the app databases, the build runner, and storing backups
Location
EU only:
Falkenstein, Germany (fsn1) — control plane, ingress, build runner
Nuremberg, Germany (nbg1) — worker node; object storage for backups (to be confirmed)
Helsinki, Finland (hel1) — worker node
Apps and the app database cluster may run on any of these nodes.
Data
All hosted app data: source code and build artefacts, app database contents, backups, app secrets, runtime and connection data
Transfer basis
Within the EU/EEA — no third-country transfer

Amazon Web Services EMEA SARL

Address
38 Avenue John F. Kennedy, L-1855 Luxembourg
Service
Amazon Route 53 (authoritative DNS for myvibecode.app)
Purpose
Resolving app subdomains to our servers; DNS-based validation for the *.myvibecode.app TLS certificate
Location
Global DNS service (name servers worldwide, including the USA)
Data
DNS records only (hostnames such as your app's subdomain, our server IP). No app content, no database data. When visitors open an app, the DNS lookup is answered by AWS name servers, which see the IP address of the querying DNS resolver (usually the visitor's internet provider).
Transfer basis
AWS Data Processing Addendum with EU Standard Contractual Clauses; Amazon.com, Inc. participates in the EU-US Data Privacy Framework

2. Services operated by OrgOps itself

These are not third parties, but they process hosted app data and are listed for completeness.

GitLab (gitlab.orgops.io) — self-operated

Purpose
Private source repository per app, container registry for app images, build pipelines; tickets for questions you escalate from the Platform Brain
Location
Hetzner Cloud, Germany (to be confirmed)
Data
App source code and container images; escalated questions

Platform Brain LLM server (llm.orgops.io) — self-operated

Purpose
Answering questions your coding agent asks the Platform Brain. Used only when your agent calls it. No third-party AI provider is involved.
Location
Hosting provider and location to be confirmed
Data
The question, app metadata (name, declared secret names — never values) and excerpts of the app's deployed source files. No database contents.

3. Services for platform account data only (no hosted app data)

For these services OrgOps is the controller, or the provider acts as an independent controller. They never receive the data stored in your apps' databases.

Microsoft (Outlook / Exchange Online SMTP)

Entity
Microsoft Ireland Operations Limited, Dublin, Ireland (to be confirmed)
Service
Outbound transactional email of the platform
Purpose
Login links, team invitations, activation and storage/domain notifications, operator alerts
Location
EU (to be confirmed)
Data
Email addresses of account holders and invited team members, app names, message content. Hosted apps cannot send email through the platform, so your app's end users are not affected.
Transfer basis
Microsoft Products and Services Data Protection Addendum with EU Standard Contractual Clauses; Microsoft Corporation participates in the EU-US Data Privacy Framework

Polar Software, Inc.

Address
548 Market St, PMB 61301, San Francisco, CA 94104, USA
Service
Merchant of Record for paid plans (checkout, payment, tax, invoice)
Role
Independent controller for the sale — not a processor of app data
Data
Purchaser's name, billing address, country, VAT ID, payment details. No app data.
Transfer basis
Transfer to the USA safeguarded by Polar's Data Processing Agreement and EU Standard Contractual Clauses

4. Other services without access to personal data

Let's Encrypt (Internet Security Research Group, USA)

Purpose
Issuing TLS certificates for *.myvibecode.app and for custom domains you connect
Data
Hostnames only. Like all publicly trusted certificates, they are published in public Certificate Transparency logs.

5. Third-party services you add to your app

Apps can make outbound connections to the internet. If you integrate external services into your app (for example an email, AI or payment API), that data flow is your decision and responsibility; those providers are not sub-processors of OrgOps.

6. Changes

We announce any new or replaced sub-processor for hosted app data at least 30 days in advance by email to account holders and on this page, as set out in section 6 of the DPA. Questions: mail@orgops.io