This page lists the current subprocessors and operational providers PageShield uses to provide, secure and support the Service. It is the live register referred to in the Data Processing Addendum ("DPA") and the Privacy Policy. Not every provider listed below processes Customer Personal Data; where a provider does not, that is noted against its entry.
| Provider | Role | Location |
|---|---|---|
| Lemon Squeezy | Merchant of Record: checkout, payment processing, invoicing, tax collection, refunds and chargebacks for paid Subscriptions. Receives payment and purchase data through its own checkout and provides PageShield with limited subscription and transaction-reference metadata. It is not intended to receive Heartbeat or Detection Event data. | Processing locations and transfers are governed by Lemon Squeezy's own documentation. |
| Hetzner | Hosting and server infrastructure: the main application environment, active database and database backups (rotated on a fourteen (14)-day cycle). | Germany / EEA. |
| Cloudflare | Authoritative DNS and basic DNS-layer protection. Not configured as an application reverse proxy; application, API, Protection Snippet, detection and switching payloads are sent directly to the Hetzner-hosted environment and are not proxied through Cloudflare. | Cloudflare service locations are governed by its own applicable documentation. |
| Google Workspace | Transactional email delivery for Account and billing notifications, support correspondence, and statutory notices such as withdrawal confirmations. Does not receive Heartbeat records, Detection Event history or Customer-configured protection data. | Processing locations and transfers are governed by Google's own documentation. |
Cloudflare and Lemon Squeezy generally act for their own purposes (DNS/network operation and Merchant-of-Record services, respectively) rather than as Subprocessors processing Customer Personal Data on PageShield's behalf, consistent with Appendix 3 of the DPA. Hetzner and Google Workspace are treated as Subprocessors to the extent they process Customer Personal Data or Account-related personal data on PageShield's behalf.
Before a new or replacement Subprocessor begins processing Customer Personal Data, PageShield will provide direct prior notice by email, dashboard notice or another durable electronic method, generally at least fifteen (15) calendar days in advance, together with sufficient information for the Customer to assess the change. Where an urgent legal, security or continuity requirement makes advance notice impracticable, PageShield will give notice as early as reasonably possible and preserve a reasonable opportunity to object on data-protection grounds, as described in Section 8 of the Data Processing Addendum. This page is kept up to date to reflect the providers currently in use.
Questions about a specific provider, or an objection to a new Subprocessor, can be sent to support@pageshield.io.