nebty GmbH engages the following sub-processors to provide its services. The platform, the database and evidence storage are operated in Germany. The other service providers process data only for the purpose stated.
We announce planned changes at least 30 days in advance (§ 6 DPA). If you would like to be notified at an additional address, or do not have a customer account of your own, write to [email protected].
For all services
| Company | Registered office | Service | Place of processing | Transfer mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH | Gunzenhausen, Germany | Platform operation, database, object storage for screenshots and evidence | Germany | – (no third-country transfer) |
| Functional Software, Inc. (Sentry) | San Francisco, USA | Error and performance monitoring of the platform | Storage in the EU; access from the USA possible | EU-U.S. Data Privacy Framework; Standard Contractual Clauses |
| Twilio Inc. (SendGrid) | San Francisco, USA | Email delivery: notifications, system messages and takedown notices | USA | EU-U.S. Data Privacy Framework; Standard Contractual Clauses |
| Google Cloud EMEA Limited | Dublin, Ireland | Google Workspace: business mailboxes including correspondence with providers during takedowns; sign-in with Google | EU; onward processing in the USA | For onward transfers to Google LLC: EU-U.S. Data Privacy Framework; Standard Contractual Clauses |
| Cloudflare, Inc. | San Francisco, USA | Protection against automated and abusive access; hosting of the website; operation of the nebty MCP server and other serverless functions (Cloudflare Pages and Workers) | Global network, USA | EU-U.S. Data Privacy Framework; Standard Contractual Clauses |
Additionally for Takedown
| Company | Registered office | Service | Place of processing | Transfer mechanism |
|---|---|---|---|---|
| Anthropic Ireland, Limited | Dublin, Ireland | AI-assisted handling of takedown cases | USA | Standard Contractual Clauses |
Additionally for Monitoring
| Company | Registered office | Service | Place of processing | Transfer mechanism |
|---|---|---|---|---|
| OpenAI Ireland Limited | Dublin, Ireland | AI-assisted assessment of findings | USA | Standard Contractual Clauses |
| OpenRouter, Inc. | USA | Access to AI models for assessing findings | USA | Standard Contractual Clauses |
| Bright Data Ltd. | Netanya, Israel | Retrieval of publicly available web content | Israel | Adequacy decision (Israel) |
| Oxylabs, UAB | Vilnius, Lithuania | Proxy infrastructure for retrieving publicly available web content | EU | – (no third-country transfer) |
| VostokInc SAS (ScrapingBee) | Paris, France | Retrieval and rendering of web pages, screenshots | France | – (no third-country transfer) |
Not sub-processors
The following process data under their own responsibility and are therefore not listed:
- Recipients of takedown notices such as registrars, hosting providers, platform operators, search engines and operators of security blocklists (§ 3(3) and § 7(4) DPA).
- Data sources queried by nebty, such as public registries, certificate transparency logs and platforms' ad libraries.
- Payment service providers involved in invoicing; invoicing is processing under nebty's own responsibility (§ 3(1) DPA).
- The Customer's own services to which the Customer forwards notifications, for example via webhook or to messaging channels (§ 11(4) DPA).