Trust Center · Subprocessors
Subprocessors
Everyone who can touch your data, with honest agreement statuses. New subprocessors are announced 30 days before they process anything.
| Processor | Role | Location | Status |
|---|---|---|---|
| Self-hosted stack (Directus, Postgres) | Identity, CMS, scan metadata storage | Frankfurt, DE — first party, no transfer | Active |
| Stripe | Payment processing | Vendor infrastructure — see vendor DPA | Pending sign-off |
| AI detection provider (OpenAI-compatible) | External scan arbiter | EU/EEA/UK pinned — keys pending | Pending keys + DPA |
| Sightengine | Dedicated AI-image detector (cached verdicts) | Vendor infrastructure — see vendor DPA | Configured per environment |
| Google Tag Manager | Analytics (statistics cookies only) | Loads only after statistics consent | Consent-gated |
| ClamAV hook | Optional malware scan of uploads | Same host when configured | Optional — fail-open in test mode |
Agency customers can request a countersigned DPA covering this list via hello@xentavi.com.