Sub-processors
Last updated: May 21, 2026
Active sub-processors
This page is the canonical sub-processor list referenced by our Privacy Policy and Data Processing Agreement. We give at least 15 days' notice before adding a new entry. Active customers may object in writing within that window.
| Provider | Purpose | Data touched | Country of processing | Transfer mechanism |
|---|---|---|---|---|
| Stripe Payments Europe Ltd | Payments, billing, customer portal | Billing fields, card tokens, VAT ID, subscription IDs | Ireland (HQ), United States (storage) | SCCs (2021) + EU-US Data Privacy Framework |
| Vercel Inc. | Marketing site hosting (noda.energy) | Request logs, page traffic | United States | SCCs (2021), UK IDTA |
| Hetzner Online GmbH | Platform infrastructure (app.noda.energy) | Application database, audit logs, object storage | Germany (Falkenstein) | EEA, no transfer outside the EU |
| Neon Inc. | Marketing-site database | Booking and lead records | Germany (Frankfurt) | EU region pinned, no transfer outside the EU |
| Resend | Transactional email | Recipient email, email body | United States | SCCs (2021) + EU-US Data Privacy Framework |
| PostHog | Product analytics | Pseudonymous events, IP truncated | Germany (eu.posthog.com) | EU cloud, no transfer outside the EU |
| Mistral AI SAS | Public-site chat assistant | Chat prompts and replies | France | EEA, no transfer outside the EU |
| Anthropic PBC | Grid report generation | Report prompts, project inputs, outputs | United States | SCCs (2021) |
| Google LLC (Calendar API) | Demo booking | Email, scheduling metadata | European Union / United States | SCCs (2021) + EU-US Data Privacy Framework |
Stripe's dual role
Stripe acts as Noda's processor for billing data we instruct it to handle and as an independent controller for card data, fraud prevention, AML/KYC checks, and other purposes Stripe determines. Stripe's own policies apply to that controller-side processing: stripe.com/privacy and stripe.com/legal/dpa.
Objection procedure
If you have an active subscription and you object to a newly listed sub-processor within 15 days, write to privacy@noda.energy. We will discuss reasonable alternatives. If none can be found, you may terminate the affected portion of the Service for cause without further fees, in line with section 8 of our Data Processing Agreement.
