(Trust)
Subprocessors
As of 5 November 2026, two companies process customer personal data on behalf of Verne Software. Both are French, and both process it in France. This is the same list as Annex III, Part A of the DPA, where they are called sub-processors.
Sub-processors engaged by Verne Software
| Name | Purpose | Data | Location | Safeguard |
|---|---|---|---|---|
| OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix, France | Hosting of the platform; storage of encrypted backups | Everything we host: end-user identities and credentials, sessions, webhook and job payloads, the audit log, logs, and the encrypted backups of the databases | France: servers in a French data centre; encrypted backups in OVHcloud Object Storage, Paris region | Not needed (inside the EEA) |
| Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, France | Sending the authentication emails, and the notices under a customer's automatic-deletion rules, to the customer's end users | Recipient address and content of verification, recovery and sign-in emails and of deletion notices | Paris (fr-par). Scaleway documents that Transactional Email runs only in that region | Not needed (inside the EEA) |
Scaleway deletes the content of a message once its sending ends: when the recipient's server accepts it, at the first hard bounce, or after 36 hours of retries. Encrypted backups of message content are kept for 7 days. Delivery records (sender and recipient address, subject, status and attempts) stay with Scaleway while our sending domain is active; Scaleway says it plans to shorten that in 2027. Source: Scaleway, Transactional Email data privacy, reviewed 19 October 2026.
When a customer leaves, we ask Scaleway to delete that customer's delivery records and keep Scaleway's written confirmation with our deletion record.
Verne Software's own access to this data from Serbia is a transfer to a third country, covered by the standard contractual clauses in the DPA (section 11). That is not a sub-processor, so it is not in the table.
Software we run ourselves
Ory Kratos (identity), Svix (webhooks), Stalwart (mail server), our own analytics and our monitoring run on our servers at OVHcloud. They are software, not outside companies, and receive nothing from us.
Sign-in providers a customer turns on
These are used only if a customer enables them. Verne Software does not engage them as sub-processors, and they act under their own relationship with the end user. Listed for transparency (Annex III, Part B).
| Provider | Used for | Location stated by the provider |
|---|---|---|
| Telegram Messenger Inc. | Sign-in with Telegram through the customer's own bot | For users who registered from the EEA or the UK: data centres in the Netherlands |
| Other providers the customer configures, for example Google or GitHub | Sign-in with that provider | As stated by each provider |
A recipient that acts as a controller
Annex III, Part C. This recipient is not engaged to process customer personal data for us. It receives the limited data shown, for the purpose shown, and decides for itself how it uses it.
| Recipient | Data received | Purpose | Location |
|---|---|---|---|
| CrowdSec SAS, 20 rue Maurice Arnoux, 92120 Montrouge, France | IP addresses that trigger our attack detection | Network security: blocking addresses known for attacks | France. Per its documentation, kept up to three months |
Not sub-processors: recipients of data we control
Two more companies receive data from us, but it is data of ours, not customer personal data. They are covered in the privacy policy, not in the DPA.
- Polar Software Inc. Sells the subscription as merchant of record and collects VAT. You give Polar your name, email, billing address, tax number and card details at checkout; we send Polar only our internal account id. Location: the United States and other countries, as Polar's own privacy policy states.
- PostHog Inc. Analytics on our public pages, documentation, and the sign-in and registration pages for Verne accounts. PostHog EU Cloud, stored in Frankfurt, Germany. It does not run on the pages that customers' end users see when they confirm or recover an account.
How we tell you about changes
- Customers with a signed DPA: we email the data protection contact named in Annex I.A at least 30 days before we add or replace a sub-processor. You can object on reasonable data protection grounds within that period. If we cannot resolve it, you can end the affected services and receive a refund of prepaid fees for the time after.
- Everyone else: we update this page and its date, and the privacy policy with it. If the change is material, we email account holders.
Questions
Verne Software is the trade name of Maksim Zhuk PR Novi Sad, an entrepreneur registered in Serbia (VAT RS113630704), Zheleznichka 20, Novi Sad, Vojvodina 21101. Our servers are in France.
Last checked: 5 November 2026.