Sub-processors — Agent Armory
Version: 2026-05-19 Status: Draft for review before publication.
This page lists the third-party service providers that Agent Armory uses to deliver the Service. It is published as required by Articles 13–14 and 28 GDPR and as part of our commitments to Enterprise customers.
We notify Enterprise customers of new sub-processors at least 30 days in advance by email (Section 17 of the Terms of Service).
| Sub-processor | Role | Data categories | Region | Transfer mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH | Hosting (VPS + storage) | All Service data | EU (Germany / Finland) | EEA — no transfer |
| Stripe Payments Europe Ltd | Subscription billing | Email, name, billing address, Stripe customer ID, subscription metadata | Ireland (EEA) + US support | Stripe DPA + SCCs + DPF |
| Resend | Transactional email (login codes) | Email address, login code, send timestamp | US | SCCs + DPF |
| Google LLC (Gemini API) | Text embeddings for search | Search queries; public catalogue text; (if opt-in) private / org Skill text | US | Google Cloud DPA + SCCs + DPF |
| GitHub Inc. | Pulls public source files for the catalogue | None — outbound only, no personal data sent | US | Not applicable (no personal data) |
| Cloudflare [if used — VERIFY] | DDoS / CDN | IP address, request metadata | Global edge | SCCs + DPF |
Notes
- Stripe is an independent controller for payment-instrument data (card numbers, fraud signals) under its own legal basis; it is our processor for the subscription metadata we push to it.
- Resend is engaged exclusively for the login-code flow; we do not use Resend for marketing.
- Google Gemini receives content only if
Embeddings__Enabled=trueand the deployment operator has accepted the external-provider disclosure flag. Private and organisation Skills are excluded by default; sending them to Gemini requires an additional explicit opt-in.
Change history
| Date | Change |
|---|---|
| 2026-05-19 | Initial publication. |
This document is a draft. Verify each line item before publication.