Legal
Subprocessors
Last updated: 20 May 2026
These are the third-party services Verkio uses to deliver the product. Each has a Data Processing Agreement on file. We give 30 days' notice before adding or replacing a subprocessor.
| Vendor | Purpose | Country | DPA |
|---|---|---|---|
| Hetzner Online GmbH | Cloud servers, Storage Box for backups | Germany (EU) | Link |
| Mollie B.V. | Subscription billing, payment processing, customer portal | Netherlands (EU) | Link |
Customer-provided integrations
Some product features let you connect a third-party service of your choice. Those third parties are not Verkio subprocessors: you remain the controller of that relationship, and the provider operates under whatever agreement you have with them directly. Verkio acts on your instruction (the saved credential) to do the work you've asked us to do.
Where this applies:
- DNS providers — Domain auto-setup writes records via your provider's API. You supply an API token (OVH, IONOS, deSEC, Cloudflare, Route 53, etc.); we publish the records you've asked us to.
- Identity providers (SSO/SCIM) — When single sign-on ships, you bring your own IdP (Okta, Entra ID, Google Workspace, etc.). Authentication and user lifecycle live in your tenant, not ours.
- Webhook endpoints — The public API pushes events to URLs you choose. Those endpoints are operated by you or by a recipient you've selected.
- External mail forwarding — If you set up a forwarding rule to an address outside Verkio, the destination mail server handles the forwarded message under your relationship with them.
- SIEM and log streaming — Audit log streaming pushes events to a destination you control — your own collector, Datadog, Splunk, or any compatible endpoint.
Where we offer a choice of default provider, we default to EU-owned options to match our infrastructure posture. US-domiciled providers are also supported, but only after an explicit per-organisation acknowledgment that the provider is US-domiciled and the relationship leaves EU-owned infrastructure. Acknowledgment and credential save are independently audit-logged.
Notice of changes
To receive notifications when this list changes, email subprocessors@verkio.eu and ask to be added to the subprocessor change list.