Sub-processors
Effective 18 October 2026
These are the third parties that process personal data for Turm. The servers, and the VM disks on them, are rented from Hetzner in Germany. We do not encrypt those disks, so the raw disks are on Hetzner's machines. If you use the model gateway, the model provider also receives the requests your agents send.
| Company | Purpose | Personal data | Location | Transfer safeguard |
|---|---|---|---|---|
| Hetzner Online GmbH, Germany | Data centre and servers that run the control plane, the database and all VMs | All data stored on the service, including VM disks | Falkenstein, Germany | Not needed (EU) |
| Stripe | Payments, tax calculation, invoices, through Stripe Checkout | Email address, name, billing address, VAT ID, payment details, subscription and account ID | Stripe. Its group includes companies in the United States | Stripe's data processing terms |
| Scaleway SAS, France | Sending login and service emails | Email address, email content (login links, notices) | Paris, France | Not needed (EU) |
| Cloudflare, Inc., United States | Authoritative DNS for our domains. The records are DNS-only, so traffic to the service and to VMs does not pass through Cloudflare | DNS queries, which carry the address of the resolver making them, and our DNS records | Global network | Cloudflare's data processing terms |
| Scaleway SAS, France | Model provider behind the model gateway (api.scaleway.ai). Used only when an agent in your VM calls the gateway | Prompts and completions your agents send through the gateway | The country named in the first column | The provider's data processing terms |
Other services
- Let's Encrypt (Internet Security Research Group) issues the TLS certificates. It receives the domain names on those certificates. That includes a VM's hostname when the VM has its own certificate instead of a wildcard.
- Better Stack hosts our public status page at turm.betteruptime.com and requests our public pages from the outside. Better Stack does not receive customer data.
Services you connect yourself
If you add an integration, such as a GitHub token, your VM's requests go to that service at your instruction. That service is your choice and is not our sub-processor.
Changes
We email account holders at least 30 days before we add or replace a sub-processor, and update this page. You can object as described in section 6 of the DPA.