Sub-processors
To deliver the HostStack service, MICCI engages the following third parties as sub-processors under GDPR Article 28. This list is authoritative and is updated whenever the set of sub-processors changes. Controllers are notified by email at least 30 days before any new sub-processor is engaged.
Hetzner Online GmbH
Germany & Finland (EU). US presence only for unrelated services not used by HostStack.Infrastructure: dedicated and cloud servers, private networking, object storage (Hetzner Storage Box / S3-compatible) for backups.
Stripe Payments Europe, Ltd.
Ireland (EU entity); US (parent).Payment processing, subscription billing, invoicing, EU VAT tax calculation (Stripe Tax), dunning.
Transfer mechanism: Stripe Standard Contractual Clauses (SCCs) for any EEA→US transfer.
PostStack (operated by MICCI)
EU (Finland).Transactional email delivery — signup, password reset, deploy notifications, billing emails, support replies.
Hosting Concepts B.V. (OpenProvider)
Netherlands (EU).Domain registrar. When you register or transfer domains through HostStack we forward registrant contact details (name, address, email, phone) to OpenProvider as required by ICANN. Optional feature — opt out by not using HostStack-managed domains.
GoDaddy Operating Company, LLC
US.Domain registrar for specific TLDs not supported by OpenProvider. Registrant contact details forwarded as required by ICANN. Optional feature.
Transfer mechanism: Standard Contractual Clauses; engaged only when you explicitly register a TLD that requires GoDaddy.
Telegram Messenger LLP
UK.Internal operational alerting (incident notifications to the on-call engineer). Payloads are aggregate / fleet-level. No Controller user PII is sent — team IDs are integers, not user identifiers.
Transfer mechanism: Not in scope for personal data of Controller's end users.
Let's Encrypt (Internet Security Research Group)
US.ACME TLS certificate issuance for custom domains attached to HostStack services. The only data transmitted is the domain name being certified.
Transfer mechanism: No personal data transferred.
Change log
- 2026-05-26 — Sub-processor list published as a standalone page (previously part of the DPA).
Questions about this list? Contact privacy@hoststack.dev. The full GDPR Article 28 terms live in our Data Processing Agreement.