Subprocessors
We use the providers below to run Published. Those we instruct are subprocessors within the meaning of Article 28 GDPR; they act only on our documented instructions and are bound by a data processing agreement. This page is the reference for our own customers and for the annex to our data processing agreement.
Subprocessors
These providers process personal data on our behalf and on our instructions.
Kinde
Authentication and user management
- Provider
- Kinde Pty Ltd, Level 4, 60 Martin Place, Sydney NSW 2000, Australia
- Processing location
- EU regions
- Transfer basis
- EU data residency for end-user authentication data; Standard Contractual Clauses under the Kinde DPA for any processing outside the EEA.
Convex
Backend infrastructure and database
- Provider
- Convex, Inc., San Francisco, CA, United States
- Processing location
- AWS eu-west-1 (Ireland)
- Transfer basis
- Application data is processed in the EU. Administrative access from the United States cannot be excluded; such access is covered by the EU Standard Contractual Clauses (Module Two) incorporated in the Convex Data Processing Addendum.
Cloudflare
Hosting, CDN, and object storage
- Provider
- Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, United States
- Processing location
- Object storage with EU jurisdictional restriction; hosting and delivery over the global edge network
- Transfer basis
- EU–U.S. Data Privacy Framework and a Data Processing Addendum with Standard Contractual Clauses.
Stripe
Payment processing
- Provider
- Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland; Stripe, Inc., South San Francisco, CA, United States
- Processing location
- EEA where possible, otherwise United States
- Transfer basis
- EU–U.S. Data Privacy Framework and Standard Contractual Clauses.
Processor on our behalf for payment processing, and independent controller for its own fraud prevention and regulatory obligations.
Google Vertex AI
AI-assisted image analysis and text generation
- Provider
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland
- Processing location
- europe-west4 (Netherlands) and the EU multi-region
- Transfer basis
- Processing takes place in the EU. Cloud Data Processing Addendum with Standard Contractual Clauses for access from outside the EEA.
Brevo
Email delivery and contact list management
- Provider
- Brevo SAS, Paris, France; DACH entity Sendinblue GmbH, Cologne, Germany
- Processing location
- European Union
- Transfer basis
- No third-country transfer takes place for this service.
webhostone
Mailbox hosting for our contact addresses
- Provider
- webhostone GmbH, Rheinvogtstraße 17, 79713 Bad Säckingen, Germany
- Processing location
- Germany
- Transfer basis
- No third-country transfer takes place for this service.
Other recipients
These parties receive personal data but decide their own purposes. They are recipients, not subprocessors, and they answer for their own processing.
Social media integrations
Publishing to social media platforms
- Provider
- The operators of Instagram, Facebook, Threads, X, Bluesky, Pinterest, and TikTok
- Processing location
- Determined by each platform
- Transfer basis
- Set out in each platform’s own privacy policy, linked below.
Not subprocessors. Each platform decides its own purposes, and content only reaches it because a user chose to publish there.
OpenStreetMap (Nominatim)
Location search for post tagging
- Provider
- OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom
- Processing location
- United Kingdom
- Transfer basis
- Adequacy decision for the United Kingdom, renewed 19 December 2025 and valid until 27 December 2031 (Article 45).
Not a subprocessor. The Foundation runs its geocoding service on its own terms; we query it without the user’s IP address.
Changes to this list
We announce a new subprocessor here before it begins processing personal data, and we notify customers who have concluded a data processing agreement with us by email at least 30 days in advance.
Within that period a customer may object to the change on reasonable data protection grounds. If we cannot resolve the objection, the customer may terminate the affected services.
The date above states when this page was last changed.