Outside companies that handle data

• Server companies, in Europe and wherever we open a location: run the servers in our locations, where your apps, databases and backups live.
• Card payments: Stripe, in the United States, Ireland and wherever it serves your card: takes the card details and the payment, and keeps your saved cards. It gets your payment and card, never your apps' data.
• The AI provider behind Sali, with servers that may be in China: answers Sali's and Sali Pro's requests. It gets what you ask and the parts of your account needed to answer, never passwords, keys or other secrets, and may not train on them.
• Email sending: delivers the emails we send you, such as login codes and receipts. It gets your email address and the email.
• Text messages, when you add a phone number for alerts: delivers them. It gets your number and the message.
• Domain registrars and registries, in the country of each domain ending: register and renew your domains. They get the owner details you give for each domain.
• Certificate authorities, in the United States and Europe: issue your sites' certificates. They get only the domain names.
• Leaked-password check, in Australia: tells us whether a new password has leaked anywhere. It gets the first 5 characters of the password's hash, never the password or who you are.
• Google and GitHub, only if you choose to log in with them or connect your code: they confirm who you are. GitHub also sends us your code when you connect it.
• Cloudflare, only if you connect your own Cloudflare account: we change your domain's records there for you.

We update this list before a new company starts handling data, with the date. Business customers under our data processing agreement are told 30 days before, and can ask for each company's name.